WO2010030133A2

WO2010030133A2 - Security file transmission system and transmission method using api in executable file format

Info

Publication number: WO2010030133A2
Application number: PCT/KR2009/005151
Authority: WO
Inventors: 이정민; 최동규; 신민철
Original assignee: 소프트캠프(주)
Priority date: 2008-09-10
Filing date: 2009-09-10
Publication date: 2010-03-18
Also published as: KR101016615B1; KR20100030319A; WO2010030133A3

Abstract

The present invention relates to a security file transmission system transmission method that enables file transmission to be performed efficiently, such as uploading and downloading of a security file between a server and a client, wherein the security of an applicable security file is based on API in an executable format that maintains stability, and comprises a server furnished with a decoding module (11) in a file format that can execute as an OS system call, and a client furnished with an interface (21) that verifies compatibility between a target file and a server upon a request for file transmission to the server and calls and removes the decoding module (11) in case of incompatibility, and with a temporary memory (22) that copies a target file so that the decoding module (11) that is called for installation and execution copies the target file and saves and deletes the copy in order to proceed with the decoding job.

Description

Security file transmission system and method using API in the form of executable file

The present invention allows a file transfer such as uploading and downloading of a security file between a server and a client efficiently, and the security of the security file is a security file transmission system and transmission method using an api of an executable file type that maintains stability. It is about.

Enterprise resource planning (ERP) is a solution that helps you manage key processes in manufacturing, procurement, inventory, ordering, trading with suppliers, and providing customer service in a variety of business areas, including manufacturing.

ERP systems are integrated based on relational databases. ERP system building can include business process analysis, user retraining, and new work procedures.

The ERP system is expressed as various programming languages, and in particular, the R / 3 program, which is an ERP system provided by SAP (Systemanalyse und Programmentwicklung), is customized and linked based on a specific programming language called Advanced Business Application Programming (ABAP).

However, the ERP system running on the ABAP is not compatible with the files of the DLL and Java class types that are widely used at present. In particular, encrypted files could not be executed at all on ERP systems.

Therefore, in order to upload the encrypted file to the ERP system, the process of decrypting the file so that it can be processed normally in the ERP system had to be preceded.

However, in order to decrypt the file to be secured, it is necessary to pay the policy of the person in charge in order to maintain the security. In the uploading process, the decryption operation and the transmission procedure of the file are performed separately, so that the operator is compatible with the ERP system. It was inconvenient to go through several cumbersome processes to transfer files that are not.

In order to solve this inconvenience, an apparatus for decryption may be added to the ERP system operating based on the ABAP. However, file encryption is based on DLL or Java class for general purpose, and ABAP is incompatible with DLL and Java class. Therefore, adding the device to ABAP-based ERP system is systematic. Very anxious and difficult

Therefore, the device may be installed on a client based on a DLL or a Java class, and the file may be first decrypted by the client and then transmitted to the ERP system before the file is transmitted to the ERP system. It could be a vulnerability in file security because it forms a path that can be maliciously decrypted and leaked to the outside.

As a result, the transmission of the security file for the ERP system has a problem that the work hassle and inefficiency, and the possibility of unauthorized leakage of the security file exists.

Therefore, the present invention has been made to solve the above problems, while improving the processing efficiency for uploading and downloading files while maintaining a stable file transfer between systems running based on a limited programming language, security of the target file The technical problem is to provide a secure file transmission system and a transmission method using an API in the form of an executable file that can improve the performance.

The present invention to achieve the above technical problem,

A server having a decoding module in a file format executable by a system call of the OS;

When requesting a file transfer to the server, the interface checks whether the target file is compatible with the server and calls and removes the decryption module when it is incompatible. A client having a temporary memory for storing and deleting a copy;

It is a transmission system of a security file using API in the form of an executable file.

The present invention to achieve the above technical problem,

A server having a decoding module in a file format executed by a system call of an OS; A client having an interface for checking whether a target file is compatible with a server and calling and removing a decryption module when the file is transmitted to the server when the file transfer request is made to the server; in a transmission system comprising: a file transfer request from the client to the server An interface executing step;

The worker requests a file transfer to a server, and the interface includes a file transfer request step of recognizing a transfer request;

The interface checks the compatibility between the transfer request target file and the server, and if it is confirmed that the server is compatible with the transfer file confirmation step of transmitting the target file to the server;

Decryption module call step of calling the decryption module to the client if it is determined that the incompatible file in the compatible file check step;

A file decryption step of decrypting a target file by a decryption module called by a client; And

Transmitting the decrypted file to the server;

It is a secure file transmission method using an api of the executable file type including a.

According to the present invention, regardless of the type of system to be driven based on a specific programming language, the transfer process for uploading and downloading files is smooth, and the security of the file is secured while stably executing interworking between systems having different operating bases. It is effective to maintain as much as possible.

1 is a block diagram showing a state of a transmission system according to the present invention;

2 is a flowchart sequentially showing a first embodiment of a transmission method according to the present invention;

3 is a flowchart specifically showing a file decoding step shown in FIG.

4 is a flowchart sequentially illustrating a second embodiment of a transmission method according to the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a transmission system according to the present invention, and FIG. 2 is a flowchart sequentially illustrating a first embodiment of a transmission method according to the present invention.

The transmission system and the transmission method according to the present invention are in the file transfer between the server (hereinafter referred to as "ERP server") and the client (20, 20 ', 20 "), the file transfer between the client and the client, the server and the client or client Even if the client and the client operate based on different programming languages, or the file to be transmitted is in a format that is incompatible with the programming language of the server or the client, the transmission of the file is maintained as well as security during file transfer.

To this end, the transmission system according to the present invention includes a decoding module 11 and an interface 21 for communicating with the decoding module 11. That is, the decryption module 11 and the interface 21 maintains the security and stability of the file transfer while performing an API function for the file transfer between the ERP server 10 and the client (20, 20 ', 20 ").

In the embodiment of the transmission system shown in FIG. 1, the ERP server 10 and a plurality of

clients

20, 20 ', and 20 "communicate with each other, and the worker is a DB of the

clients

20, 20', and 20". Upload (transfer) the specific file stored in (23) to the ERP server (10).

As described above, since the ERP server 10 operates based on the ABAP, a file of a DLL or a Java class type cannot be executed. Therefore, the dedicated file of the ERP server 10 executable in the ABAP can be sent directly from the client (20, 20 ', 20 ") to the ERP server 10, the encrypted file is to be sent to the ERP server 10 In particular, in the case of a secure file encrypted for security purposes, the file may be stored in a

client

20, 20 ', 20 "; hereinafter' 20 'unless decrypted to a file in a format compatible with the ERP server 10. Transmission to the ERP server 10 is impossible.

Accordingly, the ERP server 10 or the client 20 based on a specific programming language includes a decryption module 11 and an interface 21 for smooth file transfer, and the decryption module 11 can process the target file. Temporary memory 22, which can be a position, is installed.

In an embodiment according to the invention, the decryption module 11 is installed in the ERP server 10, the interface 21 and the temporary memory 22 is installed in the client 20.

In order to describe the transmission system according to the present invention in more detail, the transmission method according to the present invention will be described together.

S10; Interface execution step

The interface 21 is a device that mediates the communication between the ERP server 10 and the client 20. The interface 21 confirms the format of a file to be transmitted, and accordingly executes the decryption module 11 installed in the ERP server 10. Control and manage whether Therefore, in order to implement the transmission method according to the present invention, the interface 21 must be executed before transmitting the file.

S20; File transfer request step

The worker manipulates the client 20 to transmit the specific file stored in the client 20 to the ERP server 10. In general, the client 20 may include a DB 23 for storing various types of files, and the files may be configured with information such as documents (text), music (MIDI), pictures (images), and the like. .

S30; Compatibility File Check Step

When a file transfer request of an operator is input to the client 20, the interface 21 checks this and checks the format of the transfer target file located in CmdLine, which is a transmission preparation point in the system.

Since the file format that can be processed in the ERP server 10 is already known, any file format other than the file format recorded in the interface 21 can be regarded as incompatible with the ERP server 10. Therefore, the interface 21 compares the format of the file requested for transmission based on the recorded file format, and if it is the same, regards the document as compatible with the ERP server 10, and if not, the file is the ERP server 10. Is considered incompatible with). Of course, in contrast to the above-described method, the file format recorded in the interface 21 is a file which is not compatible with the ERP server 10, so that the format of the file requested for transmission is different from the file format recorded in the ERP server 10. If there is a match, it may be considered to be an incompatible file.

Meanwhile, an encryption operation may be performed to secure the contents of the file, and the encryption operation may be performed based on a format that is not compatible with the ERP server 10. Therefore, when the file format is * .txt, * .xis, * .xisx, the interface 21 may be set to recognize the transmission target file as an encrypted file.

S35; Transmission step

In the compatible file check step (S30), if the transmission target file is confirmed as a compatible file of the ERP server 10, and transmits the target file to the ERP server 10.

Since the transmission of the compatible file is a general transmission process between the ERP server 10 and the client 20, a detailed description of the transmission is omitted.

S40; Decryption module call step

In the step of confirming the compatible file (S30), if the transmission target file is identified as a file that is not compatible with the ERP server 10, the interface 21 calls the decryption module 11 included in the ERP server 10 and transmits it. (Download) receive.

The decryption module 11 forms an executable file format such as '* .exe'. The decryption module 11 is located in the ERP server 10 and is transmitted to the client 20 when the interface 21 is called.

In general, since most programming languages are designed and installed based on an OS using the SYSTEM CALL function, any file format executable through the SYSTEM CALL function may be applied as a file format of the decryption module 11. Therefore, various executable file formats such as '* .com' may be applied in addition to the '* .exe'. Meanwhile, in the embodiment according to the present invention, the name of the decoding module 11 is referred to as 'DECTool.exe'.

In the transmission system and the transmission method according to the present invention, a file having an extension of '* .exe' will be described. However, the right according to the present invention is not limited to the '* .exe' file format of the decryption module 11. However, various modifications may be made without departing from the scope of the following claims.

The decoding module 11 having an extension of an executable file such as '* .exe' operates based on different programming languages if it can be executed in the form of OS CALL without being dependent on a specific programming language such as a DLL and a Java class. The ERP server 10 and the client 20 can be executed to be compatible with each other, thereby enabling the interworking of the ERP server 10 and the client 20.

On the other hand, as the decryption module 11 is disposed on the ERP server 10 instead of the client 20, it is possible to reduce the possibility of unauthorized decryption of the secure file without proceeding, and is configured in a policy to secure the file. The prepayment process necessary for the decryption process can be performed simultaneously with the decryption process, thereby improving the efficiency and speed of the task. The prepayment process is described in detail below.

Table 1

[API source embodiment for decoding module download]

CALL FUNCTION 'DOWNLOAD_WEB_OBJECT' EXPORTING KEY = OBJDATA DESTINATION = C_PATH_FILE IMPORTING RC = RC. IF RC <> 0. RC_TEXT = 'File not found in SAP Web repository.'. EXIT. ENDIF. ENDIF. DATA: PARAMETER TYPE STRING. PARAMETER = LV_DESTINATION.

S50; File decryption step

When the decryption module 11 downloaded from the ERP server 10 is normally executed by the client 20, the encrypted transmission target file is decrypted.

Since the decryption is performed in the client 20, the decryption is performed in the following procedure to secure the decrypted file.

3 is a flowchart specifically illustrating a file decoding step shown in FIG. 2, which will be described with reference to the flowchart.

S52; File copy step

The file to be transferred is copied from the DB 23 and stored in the temporary memory 22. The temporary memory 22 may be designed to not directly access an external device other than the decryption module 11, and may allow the temporary memory 22 itself to be created and destroyed as necessary.

S54; Decryption step

The decryption module 11 decrypts the encrypted copy file stored in the temporary memory 22. Since encryption and decryption may have various formats, the decryption module 11 according to the present invention may preferably include all of these formats.

TABLE 2

[Api source embodiment for decrypting encrypted copy file stored in temporary memory]

CALL METHOD CL_GUI_FRONTEND_SERVICES => EXECUTE EXPORTING * document = file APPLICATION = FILE PARAMETER = PARAMETER * DEFAULT_DIRECTORY = * MAXIMIZED = * MINIMIZED = * SYNCHRONOUS = EXCEPTIONS CNTL_ERROR = 1 ERROR_NO_FILE_ERROR_ERROR_FO_ERROR 7 OTHERS = 8. RC = SY-SUBRC. EXFILE = LV_DESTINATION.

Meanwhile, the class of the decrypted file may be set during the decryption process. That is, it is possible to decode by limiting the use range of the decrypted file.

For example, when the decrypted file is uploaded to the ERP server 10, only the ERP server 10 can be read, or the view can be edited as well. This is to confirm whether the user may decrypt the file and upload it to the ERP server 10, thereby maintaining a high level of security for the file.

The decision on this can be changed according to the degree of authority of the worker, which will be described in detail below.

S60; Transmission step

When the decryption of the file is completed in the temporary memory 22, the decrypted file path is moved to the general upload function to the ERP server 10. As a result, the target file having a format that is decrypted and compatible with the ERP server 10 is normally transmitted (uploaded) to the ERP server 10 to perform a stable operation.

S70; Decryption document deletion step

Meanwhile, the decrypted target file stored in the temporary memory 22 may be deleted without leaving a log, thereby completely eliminating the possibility of leaking the decrypted target file. In addition, the temporary memory 22 may also be destroyed, and the decryption module 11 called from the ERP server 10 may also be removed. For reference, an embodiment of an API source for removing the decryption module 11 is described below.

The call of the decryption module 11 and the execution of the temporary memory 22 proceed each time a request for transmission to the ERP server 10 is performed for each file, and whether or not permission for decryption performed by the client 20 can be checked and determined. The decrypted file is completely destroyed with the removal of the temporary memory 22.

TABLE 3

[API source embodiment for deleting the decryption module called by the client]

WAIT UP TO 1 SECONDS. (Wait 1 second to delete the executed file) Delete downloaded decrypted file

The second embodiment of the transmission method according to the present invention further includes a step of confirming whether or not the permission of the worker attempting to transfer the file.

S37; Permission check step

The worker who attempts to transfer the file to the ERP server 10 should have the authority to transfer the file, and in order to secure the contents contained in the file, a check should be made each time whether or not the authority to transfer the file is requested.

Therefore, if there is a file transfer request, the interface 21 drives the authority check module 24 to check whether the operator who attempts the file transfer is an authorized person.

* To check the permission, you can go through the login step through ID / PW input, require a certificate, or go through a biometric method such as fingerprint identification.

On the other hand, in order to minimize the amount of communication between the ERP server 10 and the client 20, the authorization check process for the file transfer before the call to the decryption module 11 that requires communication between the ERP server 10 and the client 20 It would be desirable to proceed.

Claims

A server having a decoding module 11 in a file format executable by a system call of an OS;

When requesting a file transfer to the server, the interface 21 for checking whether the target file is compatible with the server and calling and removing the decryption module 11 when incompatible, and the decryption module 11 that is called and installed and executed are decrypted. A client having a temporary memory 22 for copying a target file to store and deleting a copy of the target file to perform a job;

Security file transmission system using api in the form of an executable file, characterized in that consisting of.
The method of claim 1,

When the interface 21 receives the request for file transfer, the authority check module 24 confirms whether the authority of the worker requesting the file transfer is selected through a method selected from a password input, a certificate check, or a biometric information of the worker. Security file transmission system using the api of the executable file type, characterized in that it further comprises a.
A server 10 having a decryption module 11 in a file format executed by a system call of an OS; Client 20 having an interface 21 for checking the compatibility of the target file and the server when the file transfer request to the server 10, the interface 21 for calling and removing the decryption module 11 when incompatible Executing an interface 21 that recognizes a file transfer request from the client 20 to the server 10;

The worker requests a file transfer to the server 10, and the interface 21 includes a file transfer request step of recognizing a transfer request;

The interface 21 checks the compatibility between the transfer request target file and the server 10, and if it is confirmed to be compatible with the server 10, transferring the target file to the server 10;

Decryption module call step of calling the decryption module 11 to the client 20, if it is confirmed that the incompatible file in the compatible file check step;

A file decoding step of decrypting the target file by the decryption module 11 called by the client 20; And

A transmission step of transmitting the decrypted file to the server 10;

Security file transmission method using an api of the executable file type, characterized in that it comprises a.
The method of claim 3, wherein

The file decoding step includes a file copying step of copying a target file and storing it in the temporary memory 22 and a decoding step of decoding a file stored in the temporary memory 22;

When the decrypted file is transmitted to the server 10 through the transmission step, the decrypted document stored in the temporary memory 22 is deleted, further comprising the step of deleting the decrypted document, characterized in that the use of the apia in the form of an executable file How to transfer secure files.
The method of claim 3, wherein

When the decrypted file is transmitted to the server 10 in the transmitting step, the decryption module 11 installed by being called by the client 20 is further removed. File transfer method.
The method of claim 3, wherein

When the file transfer request is confirmed in the file transfer request step, the security check using the API of the executable file type further comprises a step of checking the authority of the requested worker to determine whether to proceed with the file transfer procedure. File transfer method.
The method of claim 6,

The authorization check step is a security file transmission method using an api of the executable file type, characterized in that performed before the execution of the decryption module call step.