Apparatus and security system for data loss prevention, and operating method of data loss prevention apparatus

摘要

Disclosed are a DLP security system and an operating method thereof. An operating method of a data loss prevention (DLP) apparatus, comprising: converting, into packets, Ethernet signals received from a fail over device that are transmitted and received between an external network and internal network; analyzing the packets to classify the packets into first packets required to be precisely judged and second packets not required to be precisely judged; distributing and allocating a judgment job about the first packet to at least one in-line instance according to a predetermined reference; and allocating the judgment job distributed to the in-line instance in which a fail occurs to the in-line instance which is normally operated when it is verified whether there is an in-line instance which is normally operated in the case where the fail occurs in the at least one in-line instance.

主权项

1. A data loss prevention (DLP) apparatus, comprising:
an Ethernet signal matching unit converting Ethernet signals received from a fail over device that are transmitted and received between an external network and an internal network to packets; a packet processing unit classifying the packets into first packets required to be precisely judged and second packets not required to be precisely judged and transfer the second packets to the fail over device to transmit the corresponding packets to an original destination; multi instance software operating a plurality of processing instances that judges whether the first packets are final packets requiring log storing or session interruption by a predetermined judgment algorithm; a multi instance matching unit allocating a judgment job of the first packets to the plurality of processing instances according to a predetermined reference; and a management instance software verifying whether there is a processing instance which is normally operated among the plurality of processing instances when a fail occurs in at least one of the plurality of processing instances and command the multi instance matching unit to allocate the judgment job which is allocated to the processing instance in which the fail occurs to the processing instance which is normally operated when there is the processing instance which is normally operated.