# US 8,782,798 B2 · Method and apparatus for protecting data using a virtual environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,798 B2 - Document ID: US8782798B2 - Status: Granted - Kind: B2 - Application number: 13/389,883 - Filed: 2010-08-10 - Published: 2012-06-07 - Granted: 2014-07-15 - Earliest claimed: 2009-08-11 - Assignees: Ahnlab, Inc. - Applicants: Kyung Wan Kang; Kwang Tae Kim; Heean Park - Inventors: Kyung Wan Kang; Kwang Tae Kim; Heean Park - Web page: https://patentgrep.com/patent/US8782798B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention relates to a method and apparatus for protecting data using a virtual environment, which creates a safe virtual environment that supports the execution of application programs being operated on a computer and which enables important data to be inputted or outputted only within the virtual environment, such that access to the important data is prevented in a general local environment. According to the present invention, data leakage is initially prevented to protect data, and convenience is provided in that a user may use the computer in a general manner while performing desired work. ## Claims ### Claim 1 A data protection method comprising: constructing a virtual environment having therein resources that support execution of an application program in a computer; when a process generated based on the application program corresponds with a preset condition, driving the process within the virtual environment; and processing data within the virtual environment in response to a data input request or a data output request generated by the process, wherein said driving the process includes: monitoring generation of the process; determining whether the process is allowed to access the virtual environment based on a result obtained by comparing the monitored process and the preset condition; and when the process is determined to be allowed to access the virtual environment, driving the process within the virtual environment, and when the process is determined not to be allowed to access the virtual environment, driving the process outside the virtual environment. ### Claim 2 (depends on 1) The method of claim 1, wherein said constructing a virtual environment includes generating a virtual data storage unit as one of the resources within the virtual environment, the virtual data storage unit being accessible by a process driven within the virtual environment but not being accessible by a process driven outside the virtual environment. ### Claim 3 (depends on 2) The method of claim 2, wherein the virtual data storage unit includes at least any one of a virtual image file existing in a local disk of the computer, an external storage device connected to the computer, a file server connected to the computer through a network, a web hard accessible by the computer, and a file transfer protocol (FTP) host accessible by the computer. ### Claim 4 (depends on 2) The method of claim 2, wherein the data processed in response to the data input request or the data output request is processed by using the virtual data storage unit. ### Claim 5 (depends on 4) The method of claim 4, wherein when status information of the local disk is displayed on a user interface of the application program, the virtual data storage unit is mapped to the local disk to display the status information of the local disk by merging the same with status information of the virtual data storage unit. ### Claim 6 (depends on 4) The method of claim 4, wherein, in response to the data output request, the data is subjected to an encryption process based on a predefined security rule and then stored in the virtual data storage unit. ### Claim 7 (depends on 4) The method of claim 4, wherein when, in response to the data input request, the data is subjected to a decryption process based on a predefined security rule and then read from the virtual data storage unit. ### Claim 8 (depends on 1) The method of claim 1, further comprising: when there is a data transmission request for transmitting data from the virtual environment to a local environment, encrypting the data based on a predefined security rule and storing the encrypted data in a local disk of the local environment. ### Claim 9 (depends on 1) The method of claim 1, further comprising: when there is a data fetch request for fetching data from the local environment to the virtual environment, decrypting the data based on a predefined security rule and reading decrypted data. ### Claim 10 A data protection apparatus comprising: a process monitoring unit configured to monitor a process which is generated by based on an application program in a computer; a virtualization driving unit configured to construct a virtual environment having therein resources that support execution of the application program, and, when the process corresponds with a preset condition, driving drive the process within the virtual environment; and a data processing unit configured to process data within the virtual environment in response to a data input request or an output request, which is generated by the process, wherein said driving the process includes: monitoring generation of the process; determining whether the process is allowed to access the virtual environment based on a result obtained by comparing the monitored process and the preset condition; and when the process is determined to be allowed to access the virtual environment, driving the process within the virtual environment, and when the process is determined not to be allowed to access the virtual environment, driving the process outside the virtual environment. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the virtualization driving unit generates a virtual data storage unit as one of the resources, which is accessible by a process driven within the virtual environment but is not accessible by a process driven outside the virtual environment, within the virtual environment. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the virtual data storage unit includes at least any one of a virtual image file existing in a local disk of the computer, an external storage device connected to the computer, a file server connected to the computer through a network, a web hard accessible by the computer, and a file transfer protocol (FTP) host accessible by the computer. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the virtualization driving unit generates a virtualization component configured to support execution of the application program in the virtual environment. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the data processing unit processes the data in response to the data input request or the data output request by using the virtual data storage unit. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein when status information of the local disk is displayed on a user interface of the application program, the data processing unit maps the virtual data storage unit to the local disk to display the status information of the local disk by merging the same with status information of the virtual data storage unit. ### Claim 16 (depends on 14) The apparatus of claim 14, wherein, in response to the data output request, the data is subjected to an encryption process based on a predefined security rule and then stored in the virtual data storage unit. ### Claim 17 (depends on 14) The apparatus of claim 14, wherein, in response to the data input request, the data is subjected to a decryption process based on a predefined security rule and then read from the virtual data storage unit. ### Claim 18 (depends on 10) The apparatus of claim 10, wherein when there is a data transmission request for transmitting data from the virtual environment to a local environment, the data processing unit encrypts the data based on a predefined security rule and stores the encrypted data in a local disk of the local environment. ### Claim 19 (depends on 10) The apparatus of claim 10, wherein when there is a data fetch request for fetching data from the local environment to the virtual environment, the data processing unit decrypts the data based on a predefined security rule and reads decrypted data.