WO2009011496A2

WO2009011496A2 - Security system using the data masking and data security method thereof

Info

Publication number: WO2009011496A2
Application number: PCT/KR2008/003449
Authority: WO
Inventors: Chun O Park
Original assignee: Pnpsecure Inc.
Priority date: 2007-07-16
Filing date: 2008-06-18
Publication date: 2009-01-22
Also published as: JP2010533915A; WO2009011496A3; KR100820306B1

Abstract

A security system using data masking is disclosed. A query processing module receives a query from at least one user terminal and then transmits it to a relevant DBMS. A found data checking module receives and checks found data from the DBMS. A basic data management module stores a masking policy for security data. A masking module compares the found data checked by the found data checking module with the masking policy of the basic data management module and then masks relevant data. A user identification module checks information about a user who has gained access through the user terminal and information about the security level of the user. A DBMS identification module is provided with one or more application programs which are compatible with respective DBMSs so that communication can be performed regardless of the types of DBMSs. A masking server transmits the masked data to the user terminal.

Description

[DESCRIPTION] [Invention Title]

SECURITY SYSTEM USING THE DATA MASKING AND DATA SECURITY METHOD THEREOF [Technical Field]

<i> The present invention relates to a security system using data masking, which masks security data before the security data is output, thereby preventing and protecting illegal data loss, and a data security method using the security system.

<2>

[Background Art]

<3> A plurality of pieces of data stored in a database (hereinafter referred to as "DB" ) includes personal information or security information which is required to be kept secret. Therefore, it must be determined whether to provide the data depending on the qualifications (security levels) of a user attempting to access the corresponding data.

<4> FIG. 1 is a diagram showing a conventional security system for securing data, a description will be performed with reference to the drawing.

<5> A DB 20 storing various types of data, including information about columns and rows, is managed by a Database Management System (DBMS).

<6> A DBMS 10, called "DB manager" , is a program which enables a plurality of users to record data in the DB or to access the DB. The abbreviation "DBMS" is generally used.

<7> The DBMS 10 provides an efficient environment enabling information to be conveniently searched for in the DB 20 or information to be conveniently stored in the DB 20. Further, the DBMS 10 integrates data distributed for respective application software, and enables the respective application software to share the integrated data, thereby enabling information to be utilized in a systemized manner.

<8> For this purpose, the DBMS 10 defines accumulated data structures, accumulates data based on the data structures, and searches for or updates data using any of the DB languages. Further, if abnormality occurs when control is performed so that a plurality of users simultaneously executes data processing or when update is performed, the DBMS causes the process to return to a previous state obtained before the update is performed or information to be secured.

<9> A Relational Database Management System (RDBMS) is a general type of the DBMS 10, and the standardized user and program interface of the RDBMS is called Structured Query Language (SQL). With regard to the DBMS 10, Oracle, Sybase, and DB2 have been widely used.

<io> The conventional DBMS 10, which performs the above-described tasks, may further include a view table generation module 14 in order to protect the data of the DB 20.

<π> A query transmitted from the user terminal 100 is read and interpreted by the query analysis module 11 of the DBMS 10, and a data search module 12 searches the DB 20 based on the details of the interpreted query. When the search is completed and the finally found data, for example, a column, a row, or a table, is collected, a found data checking module 13 sorts the found data so that the found data matches a table entered the view table generation module 14 while analyzing and checking the collected finally found data.

<i2> However, the finally found data may include columns, rows, and tables, which are security data. Since the corresponding columns, rows, or tables cannot be transmitted and then exposed to a user terminal 100, the view table generation module 14 generates an arbitrary view table and then inserts the found data in accordance with the format of the generated view table so that the columns, rows, or tables, which are the security data, are filtered out by the DBMS 10.

<i3> However, according to the above-described conventional data security method, since the generation of view tables, attributable to joining of a plurality of tables, is frequently and repeatedly performed, the operational performance of the DBMS 10 is lowered, and data filtering is simply performed because the view table generation module 14 uniformly generates view tables, there is a problem in that control and monitoring for detailed access to important information cannot be smoothly processed.

<14> FIG. 2 is a diagram showing another embodiment of a conventional security system for securing data, and a description will be performed with reference to the drawing.

<15> As another method for securing data, there is data masking. Data masking is a process of converting the type of output data (text and shape) into another type so that a user cannot detect the details of the corresponding data.

<16> In the conventional security system, all the finally found data, found from a DB 20, is transmitted to a relevant user who transmitted a query. Here, a dedicated masking program, installed in a user terminal 100' , converts the format of security data of the finally found data into another format and then outputs the resulting data to the user terminal 100' , so that the user can check a complete table, including not only non-security data but also the security data, but cannot check the details of the security data due to the conversion, thereby enabling the protection of the security data and access to the table in detail.

<17> The dedicated masking program includes a masking policy management module 110, a masking module 120, and a found data checking module 130.

<18> A user accesses a DBMS 10' and then requests a query, and the query analysis module 11 of the DBMS 10' receives and analyzes the query and then searches the DB 20 for data requested through the data search module 12.

<i9> The finally found data is transmitted from the DBMS 10' to the user terminal 100' , and the found data checking module 130 of the user terminal 100' checks the found data and then detects whether there is data which corresponds to a reference stored in the masking policy management module 110. If the data which corresponds to the reference stored in the masking policy management module 110 is detected, the corresponding data is security data. Therefore, the masking module 120 masks the corresponding data, and then outputs the prototype of a table including the data to the user terminal 100' . <20> However, the above-described conventional data security method requires that the dedicated masking program be installed in the user terminal 100' . That is, a user terminal, in which the dedicated masking program is not installed, cannot access the corresponding DBMS 10' or cannot search for data, so that a user who must check the data of the DB 20 must install a relevant dedicated masking program.

<2i> Further, since dedicated masking programs have compatibilities which differ from each other depending on the DBMS 10' , different dedicated masking programs should be installed for respective DBs 20 when a user must access various DBs 20. That is, the conventional data security method has a lot of problems in so far as efficiency and utility because the waste of time and costs attributable to the installation of dedicated masking programs is serious and because the memory of the user terminal 100' is unnecessarily reserved.

<22> Furthermore, in order to prevent the user terminal 100' in which one or more dedicated masking programs are not installed from accessing the corresponding DBMS 10' or from searching for data, an extra security server for controlling access is required in addition to the DBMS depending on whether one or more dedicated masking programs are installed, so that there is a problem of non-efficiency in that the user terminal and the security server are required to be managed in double.

<23>

[Disclosure]

[Technical Problem]

<24> Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and an object of the present invention is to provide a security system using data masking, which removes the bother of installing a dedicated masking program in every single user terminal one by one in order to secure data through data masking, and which can be applied regardless of the type of a DBMS for controlling and managing a DB, and which can completely perform security management on the enter and exit of data by recording history concerning exposed data requested by a user, and a data security method using the security system.

<25>

[Technical Solution]

<26> In order to accomplish the above object, the present invention provides a security system using data masking, including at least one Database Management System (hereinafter referred to as "DBMS" ); and a masking server including a query processing module configured to receive a query from at least one user terminal and then transmit it to the DBMS, a found data checking module configured to receive and check found data from the DBMS, a basic data management module configured to store a masking policy for security data, and a masking module configured to compare the found data checked by the found data checking module with the masking policy of the basic data management module and then mask relevant data, the masking server being configured to transmit the masked data to the user terminal.

<27>

[Advantageous Effects]

<28> According to the present invention, there is an advantage in that data security and search efficiency can be improved because the present invention removes the bother of a user installing a dedicated masking program in every single user terminal one by one in order to search a DB in which data security is realized using data masking, can be generally applied regardless of the classification of the DBMS, and can manage the enter and exit of data in detail using a masking server.

<29>

[Description of Drawings] <30> FIG. 1 is a diagram showing a conventional security system for securing data; <3i> FIG. 2 is a diagram showing a conventional security system for securing data according to another embodiment ; <32> FIG. 3 is a diagram showing a data security system according to an embodiment of the present invention; <33> FIG. 4 is a flowchart sequentially showing a data security method according to the embodiment of the present invention; <34> FIG. 5 is a table showing an example of the output value of found data using the data security method according to the present invention; <35> FIG. 6 is a diagram showing a data security system according to another embodiment of the present invention; and <36> FIG. 7 is a flowchart sequentially showing a data security method according to another embodiment of the present invention.

<37>

[Mode for Invention]

<38> The present invention will be described in detail with reference to the accompanying drawings below.

<39> FIG. 3 is a diagram showing a data security system according to an embodiment of the present invention, FIG. 4 is a flowchart sequentially showing a data security method according to the embodiment of the present invention, and a description will be described with reference to the drawings.

<40> The security system according to the present invention includes a masking server 200 for intermediating communication between at least one user terminal 100, 101, or 102 and at least one DBMS 30, 30' , or 30" . That is, in order for a user to search for specific data and then view the data, the user should access the masking server 200 first instead of accessing the DBMS 30, 30' , or 30" for managing a DB 20, 20' , or 20" , and found data from the DBMS 30, 30' , or 30" should be transmitted to the masking server 200 first instead of being sent to the user terminal 100, 101, or 102.

<4i> The masking server 200 includes a query processing module 220 configured to check the query of the user terminal 100, 101, or 102 and transmit the query to a relevant DBMS 30, 30' , or 30" , a found data checking module 260 configured to check found data transmitted from the DBMS 30, 30' , or 30" , a basic data management module 230 configured to include the format of a table, information used to designate columns and rows which constitute the table, information about regular expressions and information about a data masking policy, a masking policy management module 240 configured to compare the data masking policy of the basic data management module with the found data, and a masking module 250 for masking data classified as security data based on the masking policy. The masking server 200 may further include a user identification module 210 for identifying a user, and a DBMS identification module 270 for identifying the DBMS 30, 30' , or 30" .

<42> The configuration of the above-described security system according to the present invention will be described in detail together with the data security method.

<43> SlO: Step of requesting query processing by user

<44> A user can search for data using a user terminal 100, 101, or 102 in which a separate dedicated masking program is not installed, and, for this purpose, attempts to access the DB 20, 20' , or 20" which stores relevant data.

<45> Here, in the security system according to the present invention, the user does not directly access the DB 20, 20' , or 20" or the DBMS 30, 30' , or 30" but goes through the masking server 200.

<46> That is, a query used to search for data which is desired for a user to view is transmitted to the masking server 200.

<47> Generally, a query used for search includes the term 'select' or union select' , so that the query analysis module 31 of the DBMS 30, 30' , or 30" causes a data search module 32 to search the DB 20, 20' , or 20" .

<48> S40: Step of transmitting query to DBMS

<49> The query transmitted from the user terminal 100, 101, or 102 is transmitted to the DBMS 30, 30' , or 30" through the query processing module 220.

<50> S50: Step of searching for data based on query

<5i> The query analysis module 31 checks the details of the query transmitted from the user terminal 100, 101, or 102, and performs control on the data search module 32 such that the DB 20, 20' , or 20" is searched for data requested by the user.

<52> S60: Step of masking server checking found data <53> When found data is transmitted from the DBMS 30, 30' , or 30" , the found data checking module 260 receives the found data and then analyzes the details thereof. <54> The found data checking module 260 according to the present invention classifies found data into tables, columns, and rows using the following method. <55> A response value of the DBMS 30, 30' , or 30" always includes the names of columns, so that a response value is transmitted while including actual details. That is, the names of respective columns, such as "DEPT" , "PARTNO" , "EMPNO" , and "NAME" , are transmitted first, and then data corresponding to the respective columns is transmitted. Meanwhile, the found data checking module 260 of the masking server 200 stores the header information of the columns in memory. <56> Further, the header information of the columns may include a delimiter for delimiting each of the rows and columns of data corresponding to security data (the targets of masking). <57> S70: Step of applying masking policy <58> The masking policy management module 240 compares the found data analyzed by the found data checking module 260 with the masking policy of the basic data management module 230, and then determines whether tables, columns, and rows, which are included in the found data, correspond to security data. <59> A method of determining whether the found data is non-security data or security data based on the masking policy includes a method using regular expressions, and a method of designating tables, columns, and rows. <60> The method using regular expressions sets up regular expressions regarding the content of a masking policy and then checks whether the value of a server response string matches one of the regular expression. The method of designating tables, columns, and rows directly designates tables, columns, and rows, which correspond to security data, and then checks whether there is found data having the same tables, columns, and rows.

<6i> Therefore, the masking policy management module 240 determines found data based on the masking policy of the basic data management module 230, and then detects data on which masking should be performed.

<62> Further, the data on which the masking should be performed can be detected using the delimiter.

<63> S80: Step of masking data

<64> The masking module 250 masks data detected at the masking policy application step at step S70, and then completes final data to be transmitted to the user terminal 100, 101, or 102.

<65> S90: Step of transmitting final data

<66> The masking server 200 transmits the final data to the user terminal 100, 101, or 102, so that the user can view the found data requested by the user. Of course, since the masking is performed on security data if the data corresponds to the security data, the user cannot check data on which the masking has been performed, so that the security of the corresponding data can be maintained.

<67> Thereafter, both the user identification module 210 and the DBMS identification module 270 are used to identify a plurality of user terminals and a plurality of DBMS 30, 30' , and 30" , a description thereof will be performed in detail with reference to FIGS.6 and 7.

<68> FIG. 5 is a table showing an example of the output values of found data using the data security method according to the present invention, and a description will be performed with reference to the drawing.

<69> The security system and the security method according to the present invention, described with reference to FIGS. 3 and 4, are executed as follows.

<70> At the user' s query processing requesting step at step SlO, the user transmits a query for requesting to search for data about some staff members who live within a predetermined area to the masking server 200 in order to detect information about the staff members who live within the predetermined area of a company.

<7i> The masking server 200 transmits the query to the DBMS 30, 30' , or 30 " at step S40 so that the DB 20, 20' , or 20" is searched for the desired data at step S50.

<72> ^■ The found data may be information about the department, position, name, resident registration number, and annual salary of each of the staff members who live within the predetermined area.

<73> The found data, including the above information, is analyzed by the found data checking module 260, so that each of the information (department, position, name, resident registration number, and annual salary) are checked at step S60.

<74> Thereafter, the masking policy management module 240 compares the information with the masking policy of the basic data management module 230, and then checks for security data at step S70.

<75> The masking policy causes the resident registration number and annual salary information to be secured, with the result that the user cannot view the corresponding information, so that the resident registration number and annual salary information is determined as security data. Here, the entire resident registration number may be security data, or just a part of the resident registration number may be the security data. In the embodiment according to the present invention, a part of the resident registration number is determined as the security data.

<76> The information determined as security data is masked by the masking module 250, and then transmitted to the user terminal at steps S80 and S90.

<77> FIG. 6 is a diagram showing a data security system according to another embodiment of the present invention, FIG. 7 is a flowchart sequentially showing a data security method according to another embodiment of the present invention, and a description will be performed with reference to the drawings.

<78> The masking server 200' of the security system according to the present invention enables data, requested by a user, to be searched for and then provided while mediating a plurality of user terminals and a plurality of DBMS 30, 30' , and 30" .

<79> For this purpose, the masking server 200' includes a user identification module 210 for identifying a user terminal which requested a query, detecting a security level set for the corresponding user, and applying a masking policy corresponding to the security level.

<80> Further, the masking server 200' may further include a DBMS identification module 270 for identifying the plurality of DBMS 30, 30' , and 30" .

<8i> As described above, since the types of DBMS 30, 30' , or 30" are various, for example, Oracle, Sybase, and DB2, the DBMS identification module 270 includes an application program which is compatible with a relevant DBMS 30, 30' , or 30" so that the masking server 200' can perform mutual data exchange while performing communication regardless of the type of the DBMS 30, 30' , or 30" .

<82> Meanwhile, the masking server 200' according to the present invention may further include a log module 280.

<83> The masking server 200' communicates with a management server 300 so as to update or change a masking policy. Further, the management server 300 checks the enter and exit of data through the masking server 200' , continuously checks the history of a user who has searched for data and the details of the data, and records information which can be used as reference for updating or changing the masking policy.

<84> For this purpose, the log module 280 records and stores found data and the history of the user who has searched for data, and the management server 300 reads the relevant information from the log module 280 and utilizes it as inspection data.

<85> For this purpose, the security method according to the present invention further includes a user identifying step performed by the user identification module 210 at step S20, a DBMS identifying step performed by the DBMS identification module 270, and a log storing step performed by the log module 280 at step SlOO.

Claims

[CLAIMS] [Claim 1]

A security system using data masking, comprising: at least one Database Management System (hereinafter referred to as " DBMS" ); and a masking server comprising a query processing module configured to receive a query from at least one user terminal and then transmit it to the DBMS, a found data checking module configured to receive and check found data from the DBMS, a basic data management module configured to store a masking policy for security data, a masking module configured to compare the found data checked by the found data checking module with the masking policy of the basic data management module and then mask relevant data, a user identification module configured to check information about a user who has gained access through the user terminal and information about a security level of the user, and a DBMS identification module provided with at least one application program which is compatible with each DBMS so that communication can be performed regardless of a type of DBMS, the masking server being configured to transmit the masked data to the user terminal.

[Claim 2]

The security system according to claim 1, further comprising a log module for recording and storing information about data, which enters and exits the user terminal and the DBMS, and information about history of the user.

[Claim 3]

A security method using data masking in a security system comprising at least one user terminal; at least one DBMS; and a masking server including a query processing module configured to receive a query from the user terminal and then transmit it to the DBMS, a found data checking module configured to receive and check found data from the DBMS, a basic data management module configured to store a masking policy for security data, and a masking module configured to compare the found data checked by the found data checking module with the masking policy of the basic data management module and then mask relevant data, the masking server being configured to transmit the masked data to the user terminal, the method comprising: a query processing requesting step of a user requesting processing of the query used to search for data from the masking server through the user terminal ; a query transmitting step of the query processing module transmitting the received query to the DBMS; a data searching step of the DBMS searching at least one DB for data corresponding to the query, completing the found data, and transmitting the found data to the masking server! a found data checking step of the found data checking module classifying and checking data which constitutes the found data; a masking policy applying step of the masking module comparing the found data checked at the found data checking step with the masking policy of the basic data management module for data relevant to the security data, and checking the found data for the data corresponding to the security data, the masking policy being set up and processed using one or more methods selected from a method of setting up regular expressions and then performing masking on a string when a value of a server response string matches one of the regular expressions, and a method of performing masking on one or more tables and columns designated by a manager; a data masking step of the masking module masking the data determined to be the security data; and a transmitting step of the masking server transmitting the masked final data to the user terminal.

[Claim 4]

The security method according to claim 3, further comprising a log o

storing step of the masking server recording information about the data transmitted to the user terminal and information about history of the user.