Core Technology

1. Remote Browser Isolation (RBI)

Overview

RBI is a technology that runs all web content on isolated servers to protect user devices. It completely blocks malicious code or scripts from websites from reaching the user's PC.

Operating Principle

Traditional Web Browsing

1. User inputs URL  
2. Browser directly accesses the website  
3. Downloads HTML, JavaScript, images, etc. locally  
4. Executes in the local browser  
└─ Risk: Malicious scripts, malware executed locally

SHIELD Gate RBI Method

1. User inputs URL  
2. Isolation server accesses the website  
3. All content is executed on the isolation server  
4. Only the rendered screen is streamed to the user  
└─ Safe: Malicious code does not reach the user's PC  
└─ Secure: Completely deleted without traces in a session-independent environment

Isolated Elements

Web Content

• HTML, CSS Parsing and Rendering
• Running JavaScript
• Plugin, ActiveX operation
• Web Fonts, Image Loading

Network

• All HTTP/HTTPS requests
• DNS query
• WebSocket Connection
• AJAX Communication

Data Storage

• Cookie
• Session Storage
• Local Storage
• IndexedDB

User Input

• Keyboard Events
• Mouse Events
• Touch Event
• File Upload

Isolation Policy Settings

Administrators can adjust the isolation level for each website.

Complete Isolation Mode

Target: Unknown site, dangerous site  
Restrictions: All input and output blocked  
- Download blocked  
- Upload blocked  
- Copy and paste blocked  
- Keyboard input blocked  
- Print blocked

Partial Isolation Mode

Target: General Work Site  
Restrictions: Block only risky functions  
- Download → Allowed after CDR processing  
- Upload → Allowed after inspection  
- Copy → Allowed only from internal to external  
- Keyboard Input → Allowed  
- Print → Add watermark

Exclusion Mode

Target: Trusted Internal System  
Limitations: None  
- All functions allowed  
- Same as direct access

User Behavior Control

action	Control Options	Application Example
Download	Allow / CDR Application / Block	General site: CDR application Risky site: Blocked
Upload	Allow / Allow after inspection / Block	Trusted sites: Allow External sites: Allow after inspection
copy	Bidirectional / Inside→Outside / Outside→Inside / Block	Work System: Bidirectional Personal Email: Internal→External Only
Paste	Bidirectional / Inside→Outside / Outside→Inside / Block	Generative AI: Pattern Inspection SNS: Block
Print	Allow / Watermark / Block	General Document: Watermark Confidential Document: Block

---

2. Zero Trust Conditional Access (ZTCA)

Overview

ZTCA is a technology that implements the zero trust principle of "never trust, always verify." It verifies all access attempts and grants only the minimum necessary permissions based on the context.

Zero Trust vs Traditional Security

Traditional Security Model (Boundary-Based)

External (Risk) ←┤ Firewall ├→ Internal (Trusted)
              
Issues:
- Free movement after entering the internal network
- VPN connection = Trusted as internal user
- Vulnerable to lateral movement attacks

Zero Trust Model

All requests → Verification → Least Privilege Granting

Features:
- Always verify regardless of network location
- Independent authentication per resource
- Dynamic permission adjustment

5 Conditions Elements

1. Who - User (Identity)

User Attributes

• User ID
• Affiliated Department
• Position, Role
• Employment Types (Full-time, Contract, Partner)

example

General Employee: Work System Access  
Project A Member: Project A Folder Access  
Administrator: Management System Access

2. Where - Location

Based on IP address

• Specific IP address
• IP Range (CIDR)
• Country, Region

example

Company IP: All functions allowed  
Home IP: Limited functions + MFA  
Overseas IP: Blocked or administrator approval

3. When - Time

Time Zone and Duration

• Specific time (09:00-18:00)
• Day of the week (Weekday, Weekend)
• Public Holiday

example

Weekdays 09-18: Normal access  
Weekday nights: View only allowed  
Weekends: Admins only allowed

4. What - Device

Device Type

• PC, laptop
• smartphone, tablet

example

Company PC: Full Access  
Smartphone: Restricted Access

5. Which - Resource

Application

• Internal Work System
• SaaS app
• website

Data Sensitivity

• Public
• Internal
• Confidential
• Secret

example

General documents: Download allowed  
Confidential documents: View only  
Secret documents: Specific users only + watermark

---

3. File Security

Overview

SHIELD Gate performs multi-layer security checks during the file upload and download process to prevent malware infections and information leaks.

Upload Security

Processing Flow

1. File Selection
   ↓
2. Malware Scan
   - Real-time Virus Scan
   - Multi-engine Scan
   ↓
3. Extension Validation
   - Allow/Deny List Check
   - MIME Type Validation
   ↓
4. Sensitive Information Detection
   - Resident Registration Number, Account Number, etc.
   - Regular Expression Pattern Matching
   ↓
5. Encrypted Storage
   - AES-256 Encryption
   - Key Management

4. Integrated Authentication (SSO)

SHIELD Gate: Easy SSO Integration

Microsoft 365, Google Workspace, Kintone, Box, etc.  
→ Automatic authentication without separate login through SAML SSO support  
└─ Effect: Improved user convenience, reduced burden of ID/PW management

Support Services

• Microsoft 365 (Outlook, Teams, OneDrive, SharePoint, etc.)
• Google Workspace
• Various SaaS services such as Kintone and Box

Advantages of SSO Integration

• No separate login procedure required
• Centralized Account Management
• Integration of Security Policies
• Maximizing User Convenience

Test Items

Malware Scan

• Virus, Trojan Horse
• Ransomware, Spyware
• Macro, Script
• Zero-Day Threat

Extension Validation

• Executable files (.exe, .msi, .bat)
• Script (.vbs, .ps1, .sh)
• Compressed files (.zip, .7z, .rar)
• Document file (.doc, .pdf, .hwp)

Sensitive Information Detection

• Resident Registration Number (000000-0000000)
• Account number, card number
• passport number, driver's license number
• Custom Patterns

Download Security

CDR (Content Disarm and Reconstruction)

CDR is a technology that completely disassembles a file to remove malicious elements and reassembles it into a safe structure.

Processing Steps

1. Original File
   ↓
2. File Structure Decomposition
   - Document Parsing
   - Metadata Extraction
   - Embedded Object Separation
   ↓
3. Risk Factor Removal
   - Macro Deletion
   - JavaScript Removal
   - External Link Removal
   - Executable Code Removal
   ↓
4. Safe File Reconstruction
   - Content Retention
   - Formatting Retention
   - Image Retention
   ↓
5. Sanitized File

Download Path Control

Users can choose the save location when downloading a file.

Save Location	Description	Security Level
User PC	Local Download Folder	Applying CDR
SHIELD Drive	Encrypted Storage	Encryption + Access Control
SHIELD Viewer	Viewer-only view	Download unavailable, read-only

---

4. Remote Access

Overview

SHIELD Gate provides remote access features that replace VPN, personal desktop access, and server console management capabilities.

Personal Desktop Remote Access

Operation Method

registration

1. User installs the agent on their personal PC  
2. Register PC on the SHIELD Gate platform  
3. Set access permissions

Connection

1. Access SHIELD Gate in the web browser  
2. Check the list of registered PCs  
3. Select a PC and start remote control

Main Features

Wake on LAN

• Turning on a powered-off PC remotely
• Schedule-based automatic power management

Conditional Access

• Time-based Access Control
• Location-Based Access Control
• Approval-based temporary access

Session Management

• Real-time Monitoring
• Forced termination

Web Server Remote Console

SSH Terminal

Web-based SSH

• Direct SSH Access from the Browser
• No separate SSH client required

File Transfer

• Drag and Drop Upload
• Download button click
• Progress Indicator

VNC/telnet support

VNC (Virtual Network Computing)

• Linux/Unix GUI Remote Control
• Web Browser Based Access

telnet

• Windows Server Remote Control
• Web Browser Based Access

---

5. SaaS Integration Support

Microsoft 365

Perfect Compatibility

• Teams Video Conference (Voice, Video, Screen Sharing)
• Office Web Apps (Word, Excel, PowerPoint)
• Outlook Web Mail
• OneDrive, SharePoint

URL Unit Control

company.sharepoint.com → Allow  
*.onedrive.com → Block personal accounts  
teams.microsoft.com → Allow video conferencing

SSO Integration

• Azure AD Integration
• Automatic Login
• Session Synchronization

---