Function Specification (Internal → External Access)
※ Last updated: 2026-10-20
This document is a functional specification for cases of securely accessing external internet and SaaS services from an internal work environment.
Common management features such as user, group, license, conditional policy, and authentication settings areSecurity365 Management Center Function Specification DocumentPlease refer to.
RFP Notation Standards
| Notation | meaning | Explanation |
|---|---|---|
| Essential | Common Evaluation Criteria | Required Features in Web Isolation (RBI) Business RFP |
| specialization | Differentiation Items | Unique features of SHIELD Gate provide an advantage over competitors — Recommended to add evaluation criteria to the RFP. |
| Selection | Additional Items | Features proposed optionally based on customer requirements |
User Features
| Major Category | Mid-category | Subcategory | Detailed Description | RFP notation | spec |
|---|---|---|---|---|---|
| Isolated Browsing | Web Access | Isolated Browser Access | Isolated browser access feature that executes web browsing on the server and streams only the screen to neutralize online threats. | Essential | link |
| Isolated Browsing | Web Access | URL input field | Provide an input field where users can directly enter a URL to access. | Essential | link |
| Isolated Browsing | Web Access | URL Input Field Search Engine Integration | A feature that automatically links to the search results page of the configured search engine (Google·Naver·Daum·Nate·Bing) when a search term that is not in URL format is entered in the URL input field. | specialization | link |
| Isolated Browsing | Web Access | App Access | Function to access external SaaS through SHIELDGate and set user-specific access permissions | Essential | link |
| Isolated Browsing | Browser Compatibility | Multi-Browser Support | Features supported by Chrome·Edge (Chromium) 109, Firefox 115, Safari 16 or higher, and Naver Whale (based on Chromium 109 or higher) — Update notification when accessing below the minimum version (notification window or guide page), Internet Explorer and old Edge (EdgeHTML) not supported | Essential | link |
| Isolated Browsing | Browser Compatibility | Support for advanced web features | JavaScript interaction, WebGL 3D rendering, basic browser features such as translation, zooming, and right-clicking. | Essential | link |
| Isolated Browsing | Browser Compatibility | Select translation language directly | A feature that allows users to directly select the target language (Korean, English, Japanese, Simplified/Traditional Chinese) from the right-click menu when translating web pages in an isolated browser — the selected language is maintained during the login session. | Selection | link |
| Isolated Browsing | Complete Isolation Architecture | Device Isolation and Code/Data Blocking | ① There is no direct communication between the device browser and the corresponding web server, and ② the script and HTML code of the web server are not executed on the device, and ③ cookies, temporary files, etc. are not stored on the device at all, resulting in a completely isolated structure. | specialization | link |
| Isolated Browsing | Complete Isolation Architecture | HTTPS Single Port Secure Communication | Connect to the RBI server using standard HTTPS (TCP 443) with a single port and single session without using UDP, and structure for 1:1 transmission without relay servers like TURN — no need for separate firewall port openings or relay infrastructure, ensuring a security level equivalent to or higher than VPN when accessing externally (IAP, etc.) | specialization | link |
| Isolated Browsing | Complete Isolation Architecture | High-Definition Screen Streaming | Immediately upon connection, the intelligent screen transmission feature prioritizes sending keyframes to ensure high quality from the initial screen, and automatically adjusts the resolution in case of network jitter to maintain responsiveness instead of interruptions. | specialization | link |
| Isolated Browsing | Security Plugin Support | Endpoint Broker Technology | Functionality that supports web applications requiring internal communication on PCs, such as bank security programs. | specialization | link |
| Access Permission | Access Environment-Based Permissions | Access Environment-Based Permissions | Function to set app usage permissions based on user location, device, and time conditions | Essential | link |
| User Behavior Control | Access Control | Access Allow/Deny | Function to allow or block access to target URLs and categories according to conditional policies | Essential | link |
| User Behavior Control | Access Control | Additional Authentication | Additional identity verification feature through email verification code or OTP authentication when access is granted | Essential | link |
| User Behavior Control | Access Control | Move URL Additional Authentication | A feature that requires additional authentication (MFA) when moving to an in-app navigable URL (related URL) to verify identity and allow access. | specialization | link |
| User Behavior Control | Behavior Control | Keyboard Input Blockade | Function to block keyboard input in the isolation browser | Essential | link |
| User Behavior Control | Behavior Control | Site Access Block | A feature that blocks page navigation outside the connected domain | Selection | link |
| User Behavior Control | Behavior Control | URL Exposure Control | A feature that controls the visibility of the current access URL in the URL input field based on conditions. | Selection | link |
| User Behavior Control | Behavior Control | Session Persistence | If the maintenance time for each viewing and working screen passes, it will stop while leaving the last screen as is, and the function to resume from the previous address with a click or scroll — warning 30 seconds before stopping, excluding stops during file transfer and video playback. | Selection | link |
| User Behavior Control | File Transfer Control | Upload Allow/Block | Allow or block file uploads in the isolated browser — SHIELD Drive supports settings to allow uploads only for approved files. | Essential | link |
| User Behavior Control | File Transfer Control | Download Allow/Block | Allowing or Blocking File Downloads in the Isolated Browser — Support for Individual Allowance of SHIELD Viewer Preview Viewing and PDF·Original·CDR Downloads | Essential | link |
| User Behavior Control | File Transfer Control | Extension Control | Function to control file upload and download by blocking extensions (only blocking registered extensions) or allowing extensions (only allowing registered extensions) | Essential | link |
| User Behavior Control | File Transfer Control | Inter-network solution transit transmission | Functionality that supports file upload and download via an existing network connection solution operating in a network separation environment. | specialization | link |
| User Behavior Control | Clipboard Control | Bidirectional Clipboard Control | Function to control copy/paste between the isolated browser and the user PC in three stages: allow in both directions, allow internally, and block. — When internally allowed, copy/paste is only supported within the isolated browser, with a warning followed by user choice (confirmation dialog, log recording for proceed/cancel). | Essential | link |
| User Behavior Control | Sensitive Information Control | Blocking Sensitive Information Input | Function to detect personal information patterns in user input and block transmission (including generative AI services) | specialization | link |
| User Behavior Control | Sensitive Information Control | Generative AI Prompt·Response Full Logging | A feature that allows for complete logging of input prompts and response content when using commercial generative AI. | specialization | link |
| User Behavior Control | Input Prompt Firewall | Text Input Validation | A function that pre-screens sensitive information at control points before inputting and transmitting text to external services such as generative AI, only delivering content that has passed the screening. | specialization | link |
| User Behavior Control | Input Prompt Firewall | File Attachment Check | Function to inspect and sanitize files at the control point before file attachment (drag-and-drop, file selection, clipboard paste), allowing only approved files to be transmitted. | specialization | link |
| User Behavior Control | Print Control | Print Allow/Block and Watermark | Allowing or blocking printing in the isolated browser — When allowed, a watermark containing user identification information may be applied. | Essential | link |
| Screen Security | Security Screen | Blocking and Guidance Screen | Display a blocking notification screen when a policy is blocked, and provide a notification screen in case of technical issues such as connection errors or session termination. | Essential | link |
| Screen Security | Screen Marking | Screen Marking | Function to display user identification information as a watermark on the screen (automatically inserted during screen capture as well) | Essential | link |
| File Security | File Encryption | Encryption Storage and Key Management | Function to encrypt and store files during upload and dispose of the encryption key when deleting files | Essential | link |
| File Security | Extension Control | Processing by Extension | Function to control uploads and downloads based on extension blocking or extension allowing methods | Essential | link |
| File Security | Malware scanning and disinfection | Malware Scanning and CDR | A feature that automatically applies malware scanning and CDR (Content Disarm and Reconstruction) processing during file upload and download. | Essential | link |
| File Security | Sensitive Information Detection | Automatic Sensitive Information Detection | A feature that automatically detects personal information within files and blocks transmission. | Essential | link |
| File Security | Grade-based control | Grade-based file transfer control | File security level (C/S/O) and automatic control of uploads and downloads according to grade ranking — business system grade display, automatic selection of SHIELD Drive storage by grade | specialization | link |
| File Security | Document Viewer Integration | SHIELD Viewer Integration | Provides a read-only preview through SHIELD Viewer when downloading files, allowing individual downloads of PDF, original, and CDR — supports separate download settings for files that cannot be previewed (unsupported extensions, large Excel files) | Essential | link |
| File Management | Storage Integration | External Storage and Edge Server | Integration features for external storage such as NAS, OneDrive, Google Drive, and Edge server-based local storage | Selection | link |
| File Management | Document Editing | Collaborative Editing | MS365·Google Docs·Hancom Web·S3/NAS based document collaboration feature | Selection | link |
| File Management | Document Editing | Read-Only Access | Read-only document viewing feature through SHIELD Viewer | Selection | link |
| File Management | Teams Integration | Teams File Integration | Features that support file viewing, uploading, editing, and team-based tab access within the Teams app | Selection | link |
| File Management | File Sharing | Sharing and Permission Management | URL link sharing, specifying sharers and setting permissions, managing shared folders | Selection | link |
| File Management | Exploration · Classification · Collaboration | Exploration and Classification | File and folder search, tagging, bookmarking, pinning important items to the top feature | Selection | link |
| File Management | Exploration · Classification · Collaboration | Collaboration and History | Document comment writing, file change notification subscription, viewing, editing, and downloading history confirmation feature | Selection | link |
| File Management | Deletion Policy | Deleted File Management | Automatically delete files after retaining them for a certain period and set the retention period for the file folder. | Selection | link |
| SaaS Support | SaaS Compatibility | Microsoft 365 | Features that support M365 services and SSO, such as Teams, Office365, Word, PowerPoint, etc. | Essential | link |
| SaaS Support | SaaS Compatibility | Video Conference | Supports voice, video, and screen sharing of video conferencing platforms such as Teams and Zoom without separate configuration. | Essential | link |
| SaaS Support | SaaS Compatibility | Video Streaming | Video streaming and DRM protected content playback support features | specialization | link |
| Interface | UI and Menu | Hide/Show Top Bar | A feature that hides or expands the top bar to support full-screen viewing and immersive browsing. | Selection | link |
| Interface | UI and Menu | Home Menu and GNB Shortcut | Setting the Home Menu Usage and Fixing Recently Accessed Apps·URLs in the GNB | Selection | link |
| Interface | UI and Menu | Custom URL Button | Add a button for calling external URLs in the top bar and a feature to pass user information as parameters. | Selection | link |
| Interface | UI and Menu | URL Bookmark (Favorites) | A feature to save frequently accessed URLs as bookmarks in an isolated browser and reconnect with a single click from the home screen or top bar — supports adding bookmarks from the URL input field, displaying name, URL, and date added, and changing order via drag and drop. | Selection |
Admin Features
| Major Category | Mid-category | Subcategory | Detailed Description | RFP notation | spec |
|---|---|---|---|---|---|
| Isolation Browser Control | Access Control Policy | Policy Management | Function to create, modify, delete access control policies for the work system by member and manage priorities. | Essential | link |
| Isolation Browser Control | Access Control Policy | Members and Conditions Settings | Function to designate the members subject to policy application and set conditions for location, time, and device. | Essential | link |
| Isolation Browser Control | Access Control Policy | Access to Business System | Function to individually set the accessibility of the app menu and URL input field menu | Essential | link |
| Isolation Browser Control | Access Control Policy | Maximum Tab Count Limit | Control the maximum number of tabs that can be opened simultaneously in the isolation browser — support for closing an open screen when the limit is reached and opening a new screen. | Selection | link |
| Isolation Browser Control | Session Management | Real-time Session Monitoring | A feature to view the resource status and tab information of all user sessions currently connected in real-time. | Essential | link |
| Isolation Browser Control | Session Management | Session Forced Termination | Function to forcibly terminate the selected session immediately or with a grace period — input termination reason (required), display countdown warning on user screen, simultaneous termination of all tabs, automatic saving of termination records supported | specialization | link |
| Access Control | App and URL Management | App Access Settings | Function to register apps accessible through SHIELDGate and set user-specific access permissions. | Essential | link |
| Access Control | App and URL Management | URL List · Group Management | A feature that registers and manages target URLs for access control and groups them for use as a unit for policy application. | Essential | link |
| Access Control | App and URL Management | Manage Moveable URLs | Function to register and control movable URLs in a specific SaaS | Selection | link |
| Access Control | App and URL Management | URL·App Security Rating Assignment | Function to specify security levels (C/S/O) for target URL/app and use them as criteria for file grading — Display grading on user screen | specialization | link |
| Access Control | App and URL Management | Add URL for Mobile Authentication Settings | Function to set whether to apply additional authentication (MFA) for movable URLs | specialization | link |
| Access Control | Web Category Management | Category View·Edit·Rollback | Function to check the category classification of the website and customize it or restore to default settings. | Essential | link |
| Access Control | Web Category Management | Automatic Classification | Automatically classify and register web categories for new URLs accessed by users — automatic mapping among over 100 standard categories of SHIELDGate, administrators can view classification results and make custom changes. | specialization | |
| Access Control | Web Category Management | Identification of AI·SaaS Services | A feature that identifies the address accessed by the user and displays it grouped by representative service name and AI type — provided when using the web category feature. | specialization | link |
| Access Control | Web Category Management | AI·SaaS Classification Status Designation | A feature that specifies and classifies company approval, disapproval, and review needed by service, and records the person and date — supports exception designation by address. | specialization | link |
| Access Control | Connection Environment Control | Connection Condition Registration | Function to register user access environment (IP, device, time, etc.) conditions and set app access permissions | Essential | link |
| Conditional Policy | Policy Management | Policy Creation, Modification, Deletion | Functionality that supports adding, editing, and deleting conditional policies, adjusting priorities, importing and exporting, and setting expiration dates. | Essential | link |
| Conditional Policy | Policy Management | Importing and Exporting Policies | Export conditional policies as a JSON (single) or ZIP (multiple) file, and the functionality to import and register backup files. | Selection | link |
| Conditional Policy | Policy Management | Policy Application Status Inquiry | Function to query policies that were actually applied (heating) and those that were not applied by period, sorted by the number of applications and the most recent application date — Excel download support | specialization | link |
| Conditional Policy | Policy Management | Policy Status Excel Download | Function to download all registered policies or search results as an Excel (.xlsx) file (provided separately from JSON backup) | Selection | link |
| Conditional Policy | Policy Management | Basic Policy Settings | Function to automatically apply pre-set defaults for condition, execution policy, and isolation security policy when registering a new conditional policy — independent default management by menu, support for initializing existing registered policies to defaults. | Essential | link |
| Conditional Policy | Policy Management | Unused Policy Automatic Deactivation | A feature that automatically deactivates conditional policies that have not been applied (heated) during the standard period set by the administrator and records the reason and timing of deactivation — helps prevent unnecessary policy accumulation and supports audit tracking. | specialization | link |
| Conditional Policy | Policy Management | Policy Integrated Search | Integrated search function to search policies by various conditions such as member (name, email, group), target site, conditions, usage status, etc. from the list of conditional policies — supports priority change while maintaining search filter state. | Essential | |
| Conditional Policy | Target Application | Member Settings | Function to designate policy application members and separately configure excluded members | Essential | link |
| Conditional Policy | Target Application | Target Site Settings | Function to select the target of policy application among the entire site, registered sites/groups, and web categories. | Essential | link |
| Conditional Policy | Target Application | AI·SaaS Classification Bundle Target | Function to designate 6 classification bundles (Company Approved · Company Not Approved · Review Needed × AI · SaaS) or individual services · addresses as policy targets — changing the classification status will also change the bundle target. | specialization | link |
| Conditional Policy | Connection Conditions | Location, Time, Device Conditions | A feature that sets the policy application environment by combining location, time, and device conditions. | Essential | link |
| Conditional Policy | Access Policy | Access Allow/Deny and Additional Authentication | Function to set URL access blocking or allowing and configure additional email·OTP authentication | Essential | link |
| Conditional Policy | Behavior Control | Keyboard · Site Navigation · URL Exposure | Keyboard input control, blocking movement outside the domain, and the ability to set URL exposure based on conditions. | Essential | link |
| Conditional Policy | Behavior Control | File Upload and Download Control | File upload and download permission settings based on conditions such as file extensions and storage — extension blocking/allowing methods, only upload files approved by SHIELD Drive, support for SHIELD Viewer download buttons (PDF, original, CDR) settings. | Essential | link |
| Conditional Policy | Behavior Control | Grade-based file transfer control | File grade and rank-based automatic control of uploads and downloads — Support for allowing or blocking uploads and downloads of files with unspecified grades. | specialization | link |
| Conditional Policy | Behavior Control | Clipboard · Screen Lock | Function to set clipboard direction permissions (allow, internal allow, block) between the isolated browser and PC, along with user choice after warnings, and session retention (viewing and working screen retention time). | Essential | link |
| Conditional Policy | Behavior Control | Screen Marking · Printing Watermark | Function to set the application of screen marking and printing watermark by conditional policy | Essential | link |
| Conditional Policy | Behavior Control | Context Menu Control | Function to control the mouse right-click menu of the RBI browser on an item-by-item ON/OFF basis for target areas (page background, text, links, images, videos, audio, input fields) — when an item is OFF, the associated shortcut keys are also blocked. | specialization | link |
| Conditional Policy | Sensitive Information Control | Blocking Sensitive Information Input | Function to detect personal information patterns in user input and block transmission (including generative AI services) | specialization | link |
| Screen Security Settings | Lock Screen Settings | Image and Message Customization | Function to customize the image and guidance message displayed on the lock screen | Selection | link |
| Screen Security Settings | Guide Screen Settings | Image and Text Customization | Function to set images and guidance text for error screens, session termination, etc. | Selection | link |
| Screen Security Settings | Screen Marking Settings | Watermark Design Settings | Function to set display information of screen marking: font, angle, spacing, transparency, and provide real-time preview. | Essential | link |
| File Security Policy | File Transfer Policy | Extension · Conditional Control | Function to set differentiated file upload/download transfer policies by extension, user, and site — Choose extension block/allow method | Essential | link |
| File Security Policy | File Transfer Policy | Clipboard and Print Watermark Control | Function to set the clipboard directionality (allow, internal allow, block) between PC and browser, and the method for applying print watermarks. | specialization | link |
| File Management | Storage Management | Storage and Edge Server Configuration | Function to integrate external storage and register/manage Edge servers | Selection | link |
| File Management | Viewer·Permission Policy | Download and Access Permission Settings | Function to set viewing, editing, uploading, and downloading permissions by download repository policy and access path. | Selection | link |
| Authentication and Integration | User Authentication | Authentication Integration | Function to set up AD integrated authentication, SSO integration, OTP, and additional email authentication | Essential | link |
| Authentication and Integration | User Authentication | Biometric Authentication (Windows Hello) | A feature that supports login and additional authentication using biometric information such as fingerprints and facial recognition based on Windows Hello. | specialization | |
| Authentication and Integration | Provisioning | User Automatic Synchronization | Function to automatically synchronize users and groups by integrating with external systems | Selection | link |
| User·Group Management | Account Management | User Registration and Management | Function to individually or batch register users and manage activation status and passwords | Essential | link |
| User·Group Management | Group Management | Group Creation and Policy Application | Function to create and manage units for organization and policy application and manage members | Essential | link |
| Administrator Settings | Role-based permissions | Separation of Administrator Roles and Notifications | Function to refine administrator roles and provide notifications when key activities occur | Essential | link |
| Administrator Settings | License Management | License Assignment | Function to assign licenses automatically or manually based on user activation status | Selection | link |
| Administrator Settings | Account Security | Security Policy Settings | Function to set account security policies such as password rules, change cycles, automatic logout, etc. | Essential | link |
| Administrator Settings | System Operation Settings | Menu · PAC · Button Settings | Function to configure the operating environment, such as menu display options, PAC file distribution/web editing, custom URL buttons, etc. | Selection | |
| Logs and Monitoring | Log Inquiry | System Log | Function to view user and administrator activity logs and support backup, archiving, and integrity verification. | Essential | link |
| Logs and Monitoring | Log Inquiry | Generative AI Usage Log | Logging the entire content of queries (Input) and responses (Output) from major generative AI services such as ChatGPT, Claude, Gemini, Grok, and Perplexity, with the ability to filter and query based on AI service, user, duration, and conversation content — this can be used to understand AI usage status by user and for auditing information leakage within the company, with support for downloading in CSV format. | specialization | link |
| Logs and Monitoring | Log Storage and Integration | Long-term Storage and SIEM Transmission | Store user logs for more than 1 year according to administrator settings, and provide proof of tampering prevention through backups and transmission functionality to SIEM (Security Information and Event Management). | specialization | link |
| Logs and Monitoring | Access Monitoring | Connection Status Dashboard | A feature that provides the status of website access and the operation status of the real-time isolation browser on a dashboard. | Essential | link |
| Logs and Monitoring | Access Monitoring | AI·SaaS Access Status Dashboard | Home dashboard function that aggregates and displays access (allow/block) to AI·SaaS services and file transfers by service, user, and classification status — supports period selection. | specialization | link |
| Logs and Monitoring | Access Monitoring | Connection Quality and Error Management | Function to measure user-side access speed and provide a reporting interface in case of errors | Selection | link |
| Logs and Monitoring | System Monitoring | Node Monitoring | Monitoring system resource usage per node in an On-Premise environment | Selection | link |