JP2008181231A - System, method and program for preventing use of computer by spoofing - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent use of a computer by spoofing with a high degree of certainty and efficiency. <P>SOLUTION: A system 100 comprises a current operation time recording part 150 for detecting the number of times that each kind of operating method, performed from the input device 205 of a computer 200, is performed during a predetermined period, and for recording it in a memory 103 as the present number of times of operation; and a user determining part 151 for determining whether or not a user during the predetermined period is the authorized user of the computer, by collating the present number of times of operation read from the memory with the basic tendency of the legitimate user to execute each kind of operating method, read from a predetermined storage device. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a computer impersonation use prevention system, a computer impersonation use prevention method, and a computer impersonation use prevention program.

With the spread of electronic commerce and the strengthening of internal control of companies, the need for information security is increasing. For example, techniques for preventing impersonation use of computers such as client PCs have been proposed. In particular, as a technique for preventing the use of computer impersonation based on the characteristics of a user operating an input device such as a keyboard or a mouse, for example, Patent Document 1 discloses that it is extremely difficult to forge and the user's psychology. The individual operates the keyboard for the purpose of providing a personal identification device that is free of resistance, has little body restraint conditions when used, is highly flexible, and can prevent impersonation due to replacement. A personal identification device for identifying the individual based on an action to be performed, wherein a keystroke event including a keystroke time when the individual keystrokes a key provided on the keyboard and specific information for identifying the key is included. And two adjacent keys when the individual continuously presses the key based on the keying event detected by the keying event detecting unit. A key sequence derived from the keystroke time of the keystroke event and a key combination derived from the key combination specified by the specific information of the two keystroke events; Among them, an individual provided with a keying event feature value calculating unit that calculates a feature value based on the keying time difference for each same combination, and a storage unit that stores the feature value calculated by the keying event feature value calculating unit An identification device or the like is disclosed.
JP 2002-149309 A

  By the way, in Patent Document 1, when determining whether or not the user is a valid user, the keystroke time difference, that is, the keyboard is typed as a feature for operating the input device (so-called operation feature, hereinafter referred to as operation feature). The time interval is used. However, such operation features are operation features that can vary greatly in time depending on the fatigue of the user and the working state (for example, the state of being at the computer while performing other work such as meals). . In such a method based on operation characteristics that can change over time, although it is a legitimate user, it is often judged as an unauthorized user, and it is difficult to prevent impersonation use of a computer appropriately. It was.

  Therefore, the present invention has been made in view of the above problems, and a main object of the present invention is to provide a technique that can prevent impersonation use of a computer with good accuracy and efficiency.

  The computer impersonation use prevention system of the present invention that solves the above problems is a system for preventing impersonation use in which a computer is used by a user other than a legitimate user of the computer. The number of executions of the operation method during a predetermined period is detected and recorded in the memory as the current operation count, the current operation count recording unit, the current operation count read from the memory, and the legitimate read from the predetermined storage device A user determination unit that compares a basic execution tendency of the various operation methods of the user and determines whether or not the user during the predetermined period is the legitimate user of the computer. A computer impersonation use prevention system that is characterized.

  In addition, the current operation count is accumulated in association with the processing purpose or execution time information of the corresponding operation method, and is registered in the operation count history database as a past operation count history, and from the operation count history database, A trend analysis that reads the past operation count history, calculates the execution frequency of the operation method during a predetermined period or during a predetermined process as the basic execution trend from the past operation count history, and stores it in the predetermined storage device It is suitable if it is provided with a part.

  A past operation number history resetting unit that resets the past operation number history registered in the operation number history database in response to an instruction from an input device or upon detection of arrival of a predetermined condition; This is preferable.

  In addition, it is preferable to provide an execution tendency receiving unit that receives an input of the basic execution tendency from an input device and stores the received basic execution tendency in the predetermined storage device.

  Further, the processing in the user determination unit is an operation that is a set of a series of operation methods based on the current operation count read from the memory and a basic execution tendency of the various operation methods of the legitimate user. For the method group, the probability that each operation method constituting the operation method group appears each time this operation number is calculated as the current operation number group appearance probability, stored in the memory, and the current operation number group appearance probability read from the memory It is preferable that the processing is executed by comparing with a predetermined threshold value read from the predetermined storage device.

  Further, the process in the user determination unit is an independence using a chi-square distribution between the number of current operations read from the memory and a basic execution tendency of the various operation methods of the legitimate user. It is preferable to execute the test by determining whether or not there is a relationship between the two.

  In addition, the process in the user determination unit is an independence using a chi-square distribution between the current operation frequency group appearance probability read from the memory and the predetermined threshold value read from the predetermined storage device. It is preferable that the test is executed by determining whether or not there is a relationship between the two.

  In addition, it is preferable that the predetermined period is the current login time and the determination process by the user determination unit is executed for each login period.

  In addition, the computer impersonation use prevention method of the present invention is a computer that is used by a user other than a legitimate user of the computer, and the computer that prevents impersonation use is a predetermined operation method performed by an input device of a computer. The process of detecting the number of executions during the period and recording it in the memory as the current operation count, the current operation count read from the memory, and the various operation methods of the legitimate user read from a predetermined storage device A method of preventing impersonation of a computer, comprising: executing a process of checking whether or not a user during the predetermined period is the legitimate user of the computer by comparing execution tendencies.

  In addition, the computer impersonation use prevention program of the present invention is a computer program that is used by a user other than a legitimate user of the computer to prevent impersonation use. The step of detecting the number of executions during the period and recording it in the memory as the current operation number, the current operation number read from the memory, and the various operation methods of the legitimate user read from a predetermined storage device A computer impersonation use prevention program, comprising: comparing the execution tendency and determining whether or not a user during the predetermined period is the legitimate user of the computer.

  In addition, the problems disclosed by the present application and the solutions thereof will be clarified by the embodiments of the present invention and the drawings.

  According to the present invention, it is possible to prevent impersonation use of a computer efficiently with good accuracy.

--- System configuration ---
Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a network configuration diagram including a computer impersonation use prevention system 100 of this embodiment. The computer impersonation use prevention system 100 (hereinafter, system 100) determines whether or not a user using a computer 200 is a valid user of the computer, so that the computer is not a valid user. It is a system that prevents impersonation use that is used by unauthorized users. In this system 100, when determining whether or not the user is a legitimate user, a feature that the user operates the input device (so-called operation habit, hereinafter referred to as an operation feature) is used.

  Here, the “computer” includes all kinds of computers such as a client PC (personal computer), a workstation, and various portable terminals. Furthermore, for example, a computer system or a large computer for logging in remotely from a PC or workstation via a communication network and performing various processes is included. In the latter case, “determining whether or not the computer is a legitimate user” means a legitimate user in a remote log-in computer system or the like (for example, receiving a legitimate user registration). It is also possible to determine whether or not there is. In the present embodiment, the “computer” is the personal computer 200, and “determining whether or not the user is a legitimate user” means the authority to log in to the personal computer (hereinafter simply referred to as a computer) 200 itself. It is determined whether or not the user is a certain user.

  Further, the basic processing functions of the system 100 for realizing the computer impersonation use prevention method of the present invention are all included in the computer 200 together with various databases associated with the system 100 as, for example, a resident application. It may be a typical form. Alternatively, it may exist as a separate system 100 connected to the computer 200 via a communication network and function as an ASP (Application Service Provider). In the latter case, for example, the system 100 is provided with basic processing functions for realizing the computer impersonation use prevention method of the present invention and various databases linked thereto, and the computer 200 is linked to them. It is sufficient to install and operate a resident application having a processing function for the purpose. In the present embodiment, the latter case will be described as an example.

  As a functional configuration of the system 100, in order to realize the function of executing the computer impersonation use prevention method of the present invention, a program database 101 such as a rewritable memory is provided with a program 102, the program 102 is read into the memory 103, and an arithmetic operation is performed. It is executed by the CPU 104 as the apparatus. The system 100 also includes an input interface 105 such as various buttons, an output interface 106 such as a display, and a communication device 107 that handles data exchange with an external device such as the computer 200. The system 100 uses the communication device 107 to connect to an external device such as the computer 200 and various networks 140 such as a public line network, the Internet, and a wireless LAN, and execute data exchange. Between the various function units of the system 100 and the communication device 107, the I / O unit 108 executes data buffering and various mediation processes.

  Subsequently, functional units that are configured and held by the system 100 based on the program 102 will be described. It is assumed that the system 100 can use a database such as the operation count history database 125. The database such as the operation frequency history database 125 may be provided in an appropriate storage device such as a hard disk drive provided in the computer device of the system 100 as in the present embodiment. Alternatively, these databases 125 and 126 may exist on the network 140 separately from the system 100. In this case, the system 100 includes a DBMS (database management system), for example, and accesses the databases 125 and 126 via the network 140 to execute processing such as information registration and information search.

  Such a system 100 includes a current operation number recording unit 150 that detects the number of executions of various operation methods performed from the input device 205 of the computer 200 during a predetermined period and records the number of operations in the memory 103 as the current operation number.

  Here, the “operation method” is, for example, a method for specifically realizing a certain “operation type”. For example, for the operation type “start application”, an operation method “double-click the icon of the application” or an operation method “press the return key after selecting the application icon” Exists. As described above, there are generally a plurality of “operation methods” for realizing various “operation types”. FIG. 2 lists various operation types and an example 1 of operation methods for realizing them as a table. The contents of the operation type and operation method determined in advance as described above may be stored in the system 100 by providing an operation type / operation method master database.

  In addition, the system 100 compares the current operation count read from the memory 103 with the basic execution tendency of the various operation methods of the legitimate user read from a predetermined storage device, A user determination unit 151 that determines whether the user is the legitimate user of the computer is provided. As the “predetermined storage device”, a database provided in the memory 103 or the hard disk of the system 100 is assumed. The same applies to the “predetermined storage device” that appears below. A more specific method for determining how to acquire the “basic execution tendency” and storing it in a predetermined storage device and for determining whether the user is a valid user will be described later. .

  Here, as described above, “determining whether or not the computer is a legitimate user” only means determining whether or not the user is a legitimate user for the personal computer 200 as in the present embodiment. For example, it is also possible to determine whether or not the user is a legitimate user with respect to a computer remotely accessed from the personal computer 200 via the communication network. In other words, according to the present system 100, when it is desired to determine the validity of a certain user, it is possible in principle to determine the validity of the user regardless of which computer the user logs in from.

  In this way, it is possible to appropriately prevent impersonation of the computer by using various operation types and operation methods that are not operation characteristics that can change over time due to, for example, user fatigue or work conditions.

  Further, in the system 100, if the predetermined period is the current login time and the determination processing by the user determination unit is executed for each login period, whether or not the user is a valid user for each login period. Can be determined, which is preferable.

  Also, how the “basic execution tendency” is specifically acquired and stored in a predetermined storage device will be described. For this purpose, the system 100 accumulates the current operation count in association with the processing purpose or execution timing information of the corresponding operation method, and registers it in the operation count history database 125 as a past operation count history. The past operation count history is read from the operation count history database 125, and the execution frequency of the operation method during a predetermined period or during a predetermined process is calculated as the basic execution trend from the past operation count history. It is preferable to include a trend analysis unit 153 stored in the storage device.

  Further, in this case, the system 100 resets the past operation frequency history registered in the operation frequency history database 125 in response to an instruction from the input device 205 or upon detection of arrival of a predetermined condition. It is preferable that the number history reset unit 154 is provided. When the user learns a new operation method, the basic execution tendency of the user's operation method may change. In such a case, the operation frequency history is reset by the past operation frequency history reset unit 154. The past operation frequency history registered in the database 125 can be reset, and the past operation frequency history can be newly registered. As a result, it is possible to appropriately prevent impersonation of the computer without inconvenience that the user is determined to be an unauthorized user even though the user is a legitimate user.

  In addition, as a modification example of how the “basic execution tendency” is specifically acquired and stored in a predetermined storage device, the system 100 accepts an input of the basic execution tendency from the input device 205. An execution tendency receiving unit that stores the received basic execution tendency in the predetermined storage device may be provided. For example, an operation feature input screen 2 that is a GUI (graphical user interface) as shown in FIG. 3 is displayed on the display 206 of the computer 200, and the user inputs a basic execution tendency from the operation feature input screen 2. That's fine. In this case, the operation feature input screen 2 may be accessed by inputting a predetermined password. Further, in this case, it is preferable to reset in response to an instruction from the input device 205 or the arrival of a predetermined condition, as in the past operation frequency history of the present embodiment.

  In order to acquire “basic execution tendency” and store it in a predetermined storage device, both the method by the operation number accumulating unit 152 and the trend analysis unit 153 of the present embodiment and the method by the execution trend receiving unit of the modified example are both. May be used properly according to predetermined conditions or the like.

  Next, a more specific method for determining whether or not the user determination unit of the system 100 is a valid user will be described.

  First, in the system 100 of the present embodiment, the processing in the user determination unit is based on the current operation count read from the memory 103 and the basic execution tendency of the various operation methods of the legitimate user. For an operation method group that is a set of a series of operation methods, the probability that each operation method constituting the operation method group appears for each operation number is calculated as a current operation number group appearance probability P (α) and stored in the memory 103. The current operation frequency group appearance probability read from the memory 103 is compared with a predetermined threshold value read from a predetermined storage device.

The operation frequency group appearance probability P (α) this time is calculated as, for example, the number (1).

  The current operation frequency group appearance probability P (α) calculated by the number (1), that is, there is an operation method i (i = 1, 2, 3,... K) that realizes a certain operation type “α”. When the number of current operations for each operation method i is n (i), the probability of the series of operation method groups i appearing n (i) times is obtained. The probability p (i) of selecting each operation method i to realize the operation type “α” as the operation characteristics of the user (that is, the basic execution tendency) is By the functions of the operation number accumulating unit 152 and the trend analysis unit 153, the operation number is obtained from the past operation number history s (i) of each operation method i read from the operation number history database 125.

  Here, in the case of the above modification in which the user himself / herself inputs an operation feature, that is, a basic execution tendency from the GUI 2 shown in FIG. 3, and the execution tendency reception unit provided in the system 100 stores it in a predetermined storage device. If so, the probability p (i) of selecting each operation method i may be determined from the basic execution tendency input by the user himself / herself. For example, in the example of FIG. 3, p (i) = 50% when “frequently used” is input for each operation method, and p (i) = 30% when “sometimes used”. Can do. Also, frequently used operations may be registered as described above on the screen as shown in FIG. In these cases, frequently used operations indicate operations that are used above a certain standard, such as a higher frequency than the average.

  For example, the current operation frequency group appearance probability calculated as the number (1) is determined in advance and compared with a threshold value stored in a predetermined storage device. For example, when the current operation frequency group appearance probability is smaller than the predetermined threshold, the user determination unit 151 determines that the user is not a valid user (possibly). Here, in the present embodiment, the current operation frequency group appearance probability is calculated for each of a plurality of operation types, and therefore the current operation frequency group appearance probability calculated for each operation type is a predetermined threshold. The legitimacy of the user is determined by comparing with the value. As a modified example, calculating the appearance probability that combines the current operation frequency group appearance probability of all operation types and comparing it with a predetermined threshold value to determine the validity of the user, etc. Also good.

  Rather than comparing all of the current operation times n (i) for each operation method i with the corresponding past operation frequency history s (i) and the probability p (i) to be selected, As described above, if the calculation is performed as the current operation frequency group appearance probability P (α) represented by a single numerical value and the user's validity is determined using this, the processing in the user determination unit 151 is simple. Therefore, it is suitable.

  Next, a modification of a specific method for determining whether or not the user determination unit of the system 100 is a valid user will be described.

  As a modified example, in the system 100, the process in the user determination unit 151 is performed between the number of current operations read from the memory 103 and the basic execution tendency of the various operation methods of the legitimate user. It may be executed by determining whether or not there is a relationship between the two by executing an independence test using a distribution.

  Specifically, for example, a case where the population can be shown as a 2 × 2 contingency table with two types of attributes as shown in FIG. 4 will be described. Here, the operation method is divided into 2 × 2 according to the type of operation method (operation method 1 and operation method 2) and the number of times each operation method is selected (current operation frequency and past operation frequency history). And the past operation frequency history, the independence is tested for the three cases (a) to (c). In the chi-square test in this embodiment, a test using the frequency is performed. Also, the contingency table need not be 2 × 2.

  If the significance level is 0.005, according to the Chi-square distribution table, the value of Chi-square is 3.841. Therefore, in each case, if the calculated verification amount T is smaller than 3.841, the current operation count and the past operation count history are not independent (there is a relationship between them). The significance level may be other numerical values such as 0.005 (5%). Similarly to the above-described method, any method other than the chi-square test may be used as long as it is a statistical method that can verify a significant difference between an expected value and an actual measurement value.

  In the case of (a), since the test amount T = 0, it is determined that the two are not independent. That is, it is determined that the user who has logged in this time is a valid user. Similarly, in the case of (b), the test amount T = 364.39, which is much larger than the value of the chi-square, and it is determined that both are independent. That is, it is determined that the user who is logged in this time is not a valid user. Similarly, in the case of (c), the current operation count of the operation method 1 and the current operation count of the operation method 2 are equal, but the test amount T = 175.69, which is larger than the value of the chi-square, Determined to be independent. That is, it is determined that the user who is logged in this time is not a valid user. When the value in the cell is 0, the test may be suppressed (stopped). In this case, the test may be performed using another method as described above.

  Further, as yet another modification of the specific method for determining whether or not the user is a valid user in the user determination unit of the system 100, a method based on the current operation frequency group appearance probability P (α) of the present embodiment. A method combining the above and a modification using the chi-square test is also conceivable. In this case, the process in the user determination unit 151 uses a chi-square distribution between the current operation frequency group appearance probability read from the memory 103 and the predetermined threshold value read from the predetermined storage device. The independence test may be executed by determining whether or not there is a relationship between the two.

  Each of the function units 150 to 154 in the system 100 described so far may be realized as hardware, or as a program 102 stored in an appropriate storage device such as the memory 103 or an HDD (Hard Disk Drive). You may do that. In this case, the CPU 104 of the system 100 reads the corresponding program from the storage device into the memory 103 and executes it in accordance with the execution of the program 102.

  Next, the functional configuration of the computer 200 will be described. The computer 200 includes a resident application 250 having a processing function for interlocking with each functional unit of the system 100 and the operation frequency history database 125 in order to realize a function of executing the computer impersonation use prevention method of the present invention. In the program database 201 such as a rewritable memory as one of the programs 202, the program 202 is read into the memory 203 and executed by the CPU 204 which is an arithmetic device. In addition, the computer 200 includes an input device 205 such as a keyboard and a mouse for performing various operations by the user, an output device 206 such as a display, and a communication device 207 that handles data exchange with an external device such as the system 100. is doing. The computer 200 uses the communication device 207 to connect to an external device such as the system 100 and various networks 140 such as a public line network, the Internet, and a wireless LAN, and exchange data. Between each program 202 of the computer 200 and the communication device 207, the I / O unit 208 executes data buffering and various mediation processes.

---- Data structure ---
Next, the data structure of the operation count history database 125 and the data structure of the current operation count recorded in the memory 103 used by the system 100 of the present embodiment will be described.

  FIG. 5 is a diagram showing an example of the data structure of the operation frequency history database 125 in the present embodiment. As shown in FIG. 5, the operation count history database 125 is a database that accumulates the current operation count in association with the processing purpose or execution time information of the corresponding operation method, and stores it as a past operation count history. This is a set of records in which information such as operation types, operation methods included in each operation type, and past operation count history of each operation method are associated with an operation method ID not shown as a key.

  FIG. 6 is a diagram illustrating a data structure example 4 of the current operation count recorded in the memory 103 by the current operation count recording unit 150 in the present embodiment. As shown in FIG. 6, the current operation count is data recorded in the memory 103 as the current operation count by detecting the number of executions of various operation methods performed from the input device 205 of the computer 200 during a predetermined period. For example, an operation method ID (not shown) or the like is used as a key to form an aggregate of records in which information such as operation types, operation methods included in each operation type, and the current operation count of each operation method are associated.

--- Processing flow example ---
Hereinafter, a processing flow example corresponding to the computer impersonation use prevention method according to the present embodiment will be described with reference to the drawings. Note that various operations corresponding to the computer impersonation use prevention method described below are realized by the program 102 that the system 100 reads into the appropriate memory 103 and executes. Such a program 102 is composed of codes for performing various operations described below.

--- Processing flow example 1 ---
FIG. 7 is a flowchart showing an example of an implementation procedure of the computer impersonation use prevention method of this embodiment. In this implementation procedure example, an overall processing flow for preventing the use of computer impersonation will be described.

  First, when the user logs in to the computer 200, the resident application 250 installed in the computer 200 is automatically activated and starts to cooperate with each program 102 of the system 100. First, the current operation count recording unit 150 of the system 100 initializes the data of the current operation count recorded in the memory 103 (see 9 in FIG. 6), and resets the numerical value of the current operation count column to zero (S100). The contents of the column other than the current operation count in the data on the current operation count recorded in the memory 103 may be read from the operation count history database 125. Alternatively, the above-described operation type / operation method master database is stored in the system. It may be provided in 100 and read from the operation type / operation method master database.

  Next, the current operation count recording unit 150 starts detecting the number of executions of various operation methods performed by the user from the input device 205 of the computer 200 during a predetermined period (S102), and stores the current operation count in the memory 103. Recording is performed (specifically, the numerical value of the number of operations this time is increased by 1) (S106).

  Between steps S102 and S106, the current operation count recording unit 150 receives a logout request or a request to end the computer impersonation use prevention method of this embodiment, specifically, a request to end the resident application 250 of the computer 200. It is checked whether it has been done (S104). If there is an input of either a logout request or an end request (S104: YES), the process proceeds to step S116 described later. If there is no input (S104: NO), the number of operations this time is recorded (S106).

  As described above, in the present embodiment, the process for recording the number of operations this time is performed in units of login periods. However, the present invention is not limited to such an example. For example, the current operation count may be accumulated twice during the current login and the previous login. Or it is good also as accumulating the frequency | count of this operation until after the predetermined time progress after logging in. Alternatively, the current number of operations may be accumulated until the number of operations is detected and recorded until a predetermined number of samples is reached.

  Next, in the system 100, the number of current operations read from the memory 103 by the user determination unit 151 is collated with the basic execution tendency of various operation methods of legitimate users read from the predetermined storage device, and the login is performed. The process proceeds to user validity determination processing for determining whether or not the user during the period is a valid user of the computer 200. Specifically, first, based on the number of current operations read from the memory 103 and the basic execution tendency of the various operation methods of the legitimate user, the operation method group that is a set of a series of operation methods, The probability that each operation method constituting the operation method group appears this time is calculated as the current operation number group appearance probability P (α) (see number (1)) (S108), and is stored in the memory 103. The current operation frequency group appearance probability read from 103 is compared with a predetermined threshold value read from the predetermined storage device to determine whether or not the current operation frequency group appearance probability is smaller than the threshold value (S110). ). When calculating the operation frequency group appearance probability P (α) this time, (1) No calculation is performed for an operation method that has never been used (P (α) is zero according to Equation 1). (2) In the case of an operation method that has never been used, calculation is performed by substituting a sufficiently small value such as 0.1 into p (i), or (3) s (1) to Either s (k) is calculated from 1, that is, it is calculated as if any operation method has been executed once.

  If the current operation frequency group appearance probability is greater than the threshold value in step S110 (S110: NO), it is determined that the logged-in user is a valid user, and the processing from step S102 is repeated. If the current operation frequency group appearance probability is smaller than the threshold value in step S110 (S110: YES), it is determined that the logged-in user is not a valid user (possibly), and the program 102 of the system 100 The resident application 250 displays a screen for requesting input of a predetermined password on the output device 205 of the computer 200 (S112), and collation processing for confirming the match of these passwords is executed (S114).

  If the passwords match in step S114 (S114: YES), the process proceeds to step S116. In step S116, the operation count accumulating unit 152 accumulates the current operation count in association with the processing purpose or execution time information of the corresponding operation method, and registers it in the operation count history database 125 as a past operation count history (S116). . If step S116 is executed, the computer impersonation use prevention flow is terminated.

  Here, as a modified example, after step S116, the process may return to step S102 and the like, and the processing of the current operation count recording unit 150 and the user determination unit 151 may be repeated again. In that case, in step S110, the user's legitimacy is suspected and the process proceeds to step S114, and it is assumed that a password is confirmed, and a plurality of passwords are issued in advance. Do not do that. However, it is inconvenient for the user that it is determined that the user is not a valid user repeatedly and the password request screen is repeatedly displayed. In this embodiment, the passwords match in step S114. It is assumed that the confirmed user is a valid user at that time, and the computer impersonation use prevention flow is terminated.

  As another modified example, when it is determined in step S110 that the user is not a legitimate user (S110: NO), the passwords match in step S114 (S114: YES), and step S116 is executed, the past operation count history The reset unit 154 may reset the past operation number history registered in the operation number history database 125 upon receiving an instruction from the input device or detecting the arrival of a predetermined condition.

  In step S114, if the passwords do not match (S114: NO), in this embodiment, the computer 200 is frozen by the program 102 and the resident application 250 of the system 100 (S118), and the computer impersonation use prevention flow is ended. .

  Here, after the computer 200 is frozen in step S118, as a modified example, the validity of the user may be confirmed by another method. For example, when the system 100 is operated by an organization that manages the user registration of the user, the user can call the user from the management organization and confirm the legitimacy of the user by various questions. Also good.

  As another modification of this flow, when it is determined in step S110 that the current operation frequency group appearance probability calculated in step S108 is significantly smaller than the threshold value, the passwords in steps S112 and S114 are used. It is possible to omit the validity check and immediately perform the computer 200 freezing in step S118.

  Although not included in this flow, the user himself / herself may be able to confirm the operation frequency history registered in the operation frequency history database 125 from the display 206 of the computer 200 or the like. FIG. 8 is an example of the operation frequency history database content confirmation screen 5 for confirming the operation frequency history registered in such an operation frequency history database 125. In the operation frequency history database content confirmation screen 5, the operation type 401, the operation method, the selection probability 402 in the basic execution tendency, and the like stored in the operation frequency history database 125 are displayed. In order for the user to refer to the operation frequency history database content confirmation screen 5, it is only necessary to input a predetermined password.

  As described above, according to this embodiment, even when an ID or password is illegally used, it is possible to prevent impersonation of the user in using the computer with good accuracy regardless of the user's fatigue state. Therefore, it is possible to prevent impersonation use of the computer efficiently with good accuracy.

  As mentioned above, although embodiment of this invention was described concretely based on the embodiment, it is not limited to this and can be variously changed in the range which does not deviate from the summary.

It is a network block diagram including the computer impersonation use prevention system of this embodiment. It is the table | surface which illustrated a part of operation type and operation method in this embodiment. It is a figure which shows an example of the operation characteristic input screen in the modification of this embodiment. It is a figure for demonstrating the example of the test of independence using the chi-square distribution which is a modification of the user determination process in this embodiment. It is a figure which shows the example of a data structure of the operation frequency history database of this embodiment. It is a figure which shows the example of a data structure of this operation frequency of this embodiment. It is a figure which shows the example of a processing flow corresponding to the computer impersonation use prevention method of this embodiment. It is a figure which shows an example of the operation frequency history database content confirmation screen in the modification of this embodiment.

Explanation of symbols

100 Computer Impersonation Prevention System 101 Program Database 102 Program 103 Memory 104 CPU
105 Input interface 106 Output interface 107 Communication device 108 I / O unit 125 Operation frequency history database 150 Current operation frequency recording unit 151 User determination unit 152 Operation frequency accumulation unit 153 Trend analysis unit 154 Past operation frequency history reset unit 140 Network 200 Computer 201 Program database 202 Program 203 Memory 204 CPU
205 Input Device 206 Output Device 207 Communication Device 208 I / O Unit 250 Resident Application

Claims (10)

A computer is used by a user other than a legitimate user of the computer to prevent impersonation,
A current operation count recording unit that detects the number of executions of various operation methods performed from a computer input device during a predetermined period and records the number as the current operation count in a memory;
The number of the current operation read from the memory and the basic execution tendency of the various operation methods of the legitimate user read from the predetermined storage device are collated, and the user during the predetermined period A user determination unit that determines whether or not the user is a valid user;
A computer impersonation use prevention system characterized by comprising: The number of operations this time is accumulated in association with the processing purpose or execution time information of the corresponding operation method, and is registered in the operation number history database as a past operation number history,
Reading the past operation count history from the operation count history database, calculating an execution frequency of an operation method during a predetermined period or during a predetermined process as the basic execution tendency from the past operation count history, and the predetermined storage device Store the trend analysis section,
Characterized by comprising,
The computer impersonation use prevention system according to claim 1. A past operation number history reset unit that resets the past operation number history registered in the operation number history database in response to an instruction from an input device or upon detection of arrival of a predetermined condition; To
The computer impersonation use prevention system according to claim 2. An input of the basic execution tendency is received from an input device, and the execution tendency receiving unit stores the received basic execution tendency in the predetermined storage device.
The computer impersonation use prevention system according to claim 1. The processing in the user determination unit is an operation method group that is a set of operation methods based on the current operation count read from the memory and the basic execution tendency of the various operation methods of the legitimate user. The probability that each operation method constituting the operation method group appears this time is calculated as the current operation number group appearance probability, stored in the memory, and the current operation frequency group appearance probability read from the memory, and a predetermined It is executed by comparing with a predetermined threshold value read from the storage device,
The computer impersonation use prevention system in any one of Claims 1-4. The process in the user determination unit performs an independence test using the chi-square distribution between the current operation count read from the memory and the basic execution tendency of the various operation methods of the legitimate user. It is executed by determining whether or not there is a relationship between them by executing,
The computer impersonation use prevention system in any one of Claims 1-4. The process in the user determination unit is an independence test using a chi-square distribution between the current operation frequency group appearance probability read from the memory and the predetermined threshold value read from the predetermined storage device. It is executed by determining whether or not there is a relationship between the two by executing
The computer impersonation use prevention system according to claim 5. The predetermined period is a current login time, and the determination process by the user determination unit is executed for each login period.
The computer impersonation use prevention system in any one of Claims 1-7. A computer used by a user other than an authorized user of the computer to prevent impersonation;
A process of detecting the number of executions during a predetermined period of various operation methods performed from a computer input device, and recording the number of operations this time in a memory;
The number of the current operation read from the memory and the basic execution tendency of the various operation methods of the legitimate user read from the predetermined storage device are collated, and the user during the predetermined period A process of determining whether or not the user is valid;
A method of preventing the use of computer impersonation, characterized in that: A computer used by a user other than an authorized user of the computer to prevent impersonation;
Detecting the number of executions of various operation methods performed from an input device of a computer during a predetermined period, and recording it in a memory as the number of operations this time;
The number of the current operation read from the memory and the basic execution tendency of the various operation methods of the legitimate user read from the predetermined storage device are collated, and the user during the predetermined period Determining whether the user is a legitimate user;
The computer impersonation use prevention program characterized by performing this.

Images