JP3841259B2 - Method for preventing unauthorized login of computer system and computer system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to authentication processing of user-specific identification information and a password input by a user who intends to use a computer or a computer system (hereinafter collectively referred to as a computer system), and particularly attempts to illegally use a computer system. The present invention relates to a defense method of a computer system against a brute force attack in which an attacker tries passwords one by one.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, in a computer system, in order to prevent unauthorized users from illegally using resources such as data and application programs owned by the computer system, user-specific identification information (hereinafter referred to as user ID) and a password are input. Authenticates whether these match the user ID and password of a legitimate user registered in advance in the computer system. If not registered, it is determined that the login operation is performed by an unauthorized user. Generally, a method of not permitting this is adopted. Usually, a relatively easy-to-understand user name such as the user's name is selected as the user ID, and a password that each user can only understand is selected.
[0003]
As an attack method to be taken when an unauthorized user intrudes into a computer against a computer system configured to perform such authentication processing to prevent unauthorized use, first, a user ID is obtained, and the user ID is assigned to the user ID. There is a so-called “brute force attack” method in which passwords are tried one by one. Although there are a lot of password candidates, the process to perform a “brute force attack” can be automated by creating a dedicated program, so thousands of unauthorized users are extremely numerous in about one second. You can try many passwords. In this way, by allowing an unauthorized login operation through many password attempts, the password is eventually unlocked.
[0004]
Therefore, an upper limit is set for the number of unauthorized login operations, and if the unauthorized login operation exceeds the upper limit, the computer system is shifted to the lockout state, and login operations of all users to the computer are prohibited for a certain period. There is something to do. This is called a lockout method. As a result, the intruder cannot try many passwords, and the unauthorized use of the computer system by unauthorized users can be prevented, and the safety of data in the computer system can be maintained. The lockout method is described in, for example, Japanese Patent Application Laid-Open No. 11-143834.
[0005]
[Problems to be solved by the invention]
When adopting the lockout method, the login prohibition period (lockout period) is usually determined by the system administrator in accordance with the security policy of the corresponding computer system, but it is a relatively long time. You may not be able to log in again without releasing the status. Therefore, if a lockout is applied, a legitimate user cannot use the computer system for a certain period.
[0006]
Also, paying attention to the fact that if a legitimate user who possesses the user ID used for unauthorized login is logged out, the computer system cannot be used for a certain period of time. If an unauthorized login is attempted using the ID and the lockout state is intentionally entered, there is a risk of an attack that makes the user's use of the computer system impossible.
[0007]
An object of the present invention is to provide a computer system defense method that is more convenient for a legitimate user than a conventional lockout method against a password brute force attack.
[0008]
[Means for Solving the Problems]
  In order to achieve the above object, in the present invention, the input password is analyzed to determine whether or not the attack is by an attacker, and after the attacker has made several password attempts, the attack is performed. When an attacker enters an illegal password, a method is employed in which the attacker logs in to a computer (fake server) different from the computer (server) targeted for attack (hereinafter referred to as pseudo login). The amount of time it takes for an attacker to take a pseudo login can increase the time it takes for the attacker to unlock the correct password. Even during an attack by an attacker, a legitimate user can use the original server of the computer system by inputting the correct password.Furthermore, in the present invention, the user ID and password (pseudo login information) input by the attacker when logging in to the fake server are stored, and the attacker uses the same computer ID and password to re-use the computer system. If an attempt is made to intrude, login to a fake server immediately.
[0009]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 shows a block diagram of a system configuration in an embodiment of the present invention. In the figure, a computer system 100 is connected to a client 150 through a network 140 such as the Internet. Many clients 150 exist on the network 140, but only one is shown in FIG. 1 for convenience.
[0010]
  The computer system 100 is a system that provides various data, application programs, and the like to the user of the client 150, and includes a gateway 110, a server 120, and a fake server 130. The gateway 110 is a computer that performs login processing, routing, attacker behavior analysis, and attacker behavior restriction, and includes a gateway control unit 111, a password storage unit 112, an erroneous input pattern storage unit 113, a counter 114, and a restricted behavior pattern storage unit. 115 and a pseudo login information storage unit 116. The gateway control unit 111 is for controlling a series of processes such as login, routing, attacker behavior analysis, and attacker behavior restriction. The password storage unit 112 stores the passwords of all users who have authority to use the server 120 of the computer system 100.In association with the user IDIt is for storing. The erroneous input pattern storage unit 113 is for storing a password input error pattern. The counter 114 is for counting the number of attacks by the attacker, and in this embodiment, it is prepared for each user. The restricted action pattern storage unit 115 is for storing an action pattern for restricting an attacker in the fake server 130 (hereinafter referred to as a restricted action pattern). The pseudo login information storage unit 116 is for storing pseudo login information.
[0011]
FIG. 2 is a diagram illustrating an example of pseudo login information stored in the pseudo login information storage unit 116. In the example shown in FIG. 2, the user ID and password input by the attacker when the computer system 100 has made the attacker perform pseudo login in the past are stored. The pseudo-login information is used when an attacker who thinks that the computer system 100 has been successfully invaded attempts to enter the computer system 100 again using the same user ID and password used in the previous attack. The gateway 110 is used to cause the attacker to perform pseudo login again.
[0012]
Returning to FIG. 1, the server 120 is a computer that provides various application programs to the user, and stores various important information in the computer system 100. FIG. 3 is a diagram illustrating an example of information stored in the server 120. In the example shown in FIG. 3, the name and telephone number of the customer managed by the computer system 100 are stored.
[0013]
The fake server 130 is a computer for making an attacker perform a pseudo login and providing various application programs and the like, and stores various fake information that appears to be important information in the computer system 100 at first glance. Has been. FIG. 4 is a diagram illustrating an example of fake information stored in the fake server 130. In the example shown in FIG. 4, the fake name and telephone number of the customer are stored as if in FIG.
[0014]
The client 150 is a client computer that allows a user to use the computer system 100 from a remote location, and includes an input unit 151, a client control unit 152, and a display unit 153. The input unit 151 is for a user to input information, and specifically includes a keyboard and a mouse. The client control unit 152 is for controlling a series of processes accompanying login from the client 150. The display unit 153 is for displaying information to the user, and a specific example is a display.
[0015]
In this embodiment, a situation where a user logs in to the server 120 of the computer system 100 from a remote place using the client 150 is targeted.
[0016]
FIG. 5 shows an overall flowchart of the login process in the present embodiment. Hereinafter, it demonstrates according to this.
A user who wants to use the server 120 of the computer system 100 from a remote location inputs a login request to the server 120 from the input unit 151 of the client 150 (step 501). When the login request is input, the client control unit 152 transmits the login request to the computer system 100 (step 502). In the computer system 100, when the login request is received via the network 140, the gateway control unit 111 generates a session key that is a key for encrypting the password (step 503). As the session key, a different value is randomly generated every time a login request is made. When the session key is generated, the gateway control unit 111 transmits the session key and login screen information to the client 150 (step 504). On the client 150 side, when the session key and login screen information are received via the network 140, the client control unit 152 displays a login screen on the display unit 153 based on the login screen information (step 505).
[0017]
FIG. 6 shows an example of a login screen displayed on the display unit 153 of the client 150 in step 505. In the figure, 601 is a user ID input area, and 602 is a password input area.
[0018]
When the login screen is displayed, the user inputs a predetermined user ID and password from the input unit 151 (step 506). When the user ID and password are input, the client control unit 152 encrypts the password with the received session key using a predetermined encryption algorithm (step 507). Note that the encryption algorithm is not the one in question in the present invention, and may be an arbitrary algorithm. When the password is encrypted, the client control unit 152 transmits the previously input user ID and the encrypted password to the computer system 100 (step 508).
[0019]
When the computer system 100 receives the user ID and the encrypted password via the network 140, the gateway control unit 111 determines the validity of the user ID and the password. On the other hand, login to the server 120 is permitted, and if it is not valid, the login is not permitted (step 509).
[0020]
FIG. 7 is a flowchart showing details of step 509 in FIG. When the user ID and the encrypted password are received via the network 140, the gateway control unit 111 decrypts the encrypted password with the session key (step 701). When the encrypted password is decrypted, the gateway control unit 111 extracts a valid password corresponding to the received user ID from the password storage unit 112, and compares whether the decrypted password matches the valid password ( Step 702). The password in the password storage unit 112 is encrypted by a predetermined encryption algorithm, and is protected so that it cannot be decrypted by an external user. In step 702, if the passwords match, the gateway control unit 111 regards the user who has made the login request as a valid user having authority to use the server 120, and permits the user to log in to the server 120. (Step 707). When the login is permitted, the gateway control unit 111 transmits the user ID of the user to the server 120 and relays communication between the client 150 and the server 120.
[0021]
FIG. 8 is a diagram showing an example of a successful login screen in step 707 of FIG. A user who is permitted to log in can use various data, application programs, and the like provided by the server 120 of the computer system 100 from the client 150 through the network 140 within the authority of the user.
[0022]
On the other hand, if the passwords do not match in step 702, the gateway control unit 111 retrieves the pseudo login information from the pseudo login information storage unit 116, and the received user ID and the decrypted password are stored in the pseudo login information. It is compared whether or not it matches the password (step 703). If the passwords match in step 703, the process proceeds to step 711 to perform a pseudo login process. Details of this will be described later.
[0023]
If the passwords do not match in step 703, the gateway control unit 111 retrieves the erroneous input pattern from the erroneous input pattern storage unit 113, and compares whether or not the decrypted password matches the correct password erroneous input pattern (step 703). 704).
[0024]
FIG. 9 is a diagram illustrating an example of erroneous input patterns stored in the erroneous input pattern storage unit 113. In the example shown in FIG. 9, as an incorrect input pattern of a correct password, 901 “I mistakenly hit the next key”, 902 “Improper uppercase and lowercase letters”, and 903 “An extra key between For example, there is a pattern that can be considered as a case where a legitimate user who knows the correct password incorrectly inputs the password.
[0025]
FIG. 10 is a diagram illustrating an example of erroneous input pattern matching determination in step 704 of FIG. In the example shown in FIG. 10, the correct password is “kon2chi =”, and the decrypted password is “kom2chi”. In this case, the difference between the correct password and the decrypted password is only the third character “n” and “m”. Usually, in the keyboard layout of a computer, the “n” key and the “m” key are adjacent to each other. Therefore, in the case of this example, the gateway control unit 111 determines that the error input pattern of FIG.
[0026]
In step 704, if the input pattern matches the incorrect input pattern, the gateway control unit 111 regards that a legitimate user who has authority to use the server 120 inputs the password incorrectly, and transmits login failure screen information to the client 150. Thus, the user refuses to log in to the server 120.
[0027]
When the client 150 receives the login failure screen information via the network 140, the client control unit 152 displays the login failure screen on the display unit 153 based on the login failure screen information (step 708). FIG. 11 shows an example of the login failure screen in step 708. When the login failure screen is displayed, the user again inputs the user ID and password from the input unit 151. That is, the processing is resumed from step 506 in FIG.
[0028]
Returning to FIG. 7, in step 704, if it does not match the incorrect input pattern, the gateway control unit 111 considers that the attacker has randomly input the password in the brute force attack and corresponds to the user ID used by the attacker. 1 is added to the value of the counter 114 (step 705). When the value of the counter 114 is added, the gateway control unit 111 determines whether or not the value of the counter 114 has reached a threshold Nu set in advance for each user (step 706). When the value of the counter 114 has not reached Nu, the process proceeds to step 708, and the gateway control unit 111 rejects the login. When the value of the counter 114 reaches Nu, the gateway control unit 111 adds pseudo login information including the user ID used by the attacker, the decrypted password, and the like to the pseudo login information storage unit 116 ( Step 709) After clearing the value of the counter 114 to 0 for all users (Step 710), the attacker is allowed to log in to the fake server 130 that is different from the server 120 requesting login (Step 710). Step 711). When the login is permitted, the gateway control unit 111 transmits the user ID used by the attacker to the fake server 130, relays communication between the client 150 and the fake server 130, and monitors the behavior of the attacker. To do.
[0029]
As described above, the gateway control unit 111 relays both the communication between the client and the server 120 in which the legitimate user is involved, and the communication between the client and the fake server 130 in which the attacker is involved. The gateway control unit 111 can grasp whether the person involved in the relayed communication is a valid user or an attacker from the pseudo login information in the pseudo login information storage unit 116. The gateway control unit 111 does not particularly limit the communication involved with a legitimate user when relaying.
[0030]
FIG. 12 shows an example of a pseudo login screen in step 711 of FIG. FIG. 12 is the same as the login success screen of FIG. 8 at first glance. An attacker who is permitted to log in can use various data, application programs, and the like provided by the fake server 130 of the computer system 100 from the client through the network 140 as long as the restricted action pattern described later is not touched. Therefore, for the time being, it is possible to make an attacker think as if the login of the server 120 was successful.
[0031]
Here, the reason for setting the threshold Nu will be described. Of course, legitimate users can expect to enter the correct password when logging in, but completely deny the possibility that the legitimate user will enter a string unrelated to the correct password when logging in. Can not. For this reason, in step 704, if a pseudo login is performed immediately even if it does not match the erroneous input pattern, there is a possibility that a legitimate user is logged into the fake server 130. Moreover, since it seems that the login was successful in the first attack, the attacker is completely suspicious by the attacker. Therefore, it is necessary to set a certain large threshold value Nu. However, if the threshold Nu is made too large, there is a high possibility that an attacker will apply the correct password before reaching the threshold Nu and log in to the server 120. When setting the threshold Nu, an appropriate value should be set in consideration of such circumstances.
[0032]
Next, the reason why the value of the counter 114 is cleared for all users in Step 710 will be described. There is a possibility that after an attacker performs a pseudo login, an attacker different from the attacker may attempt to enter the computer system 100. At this time, if the value of the counter 114 is not cleared for all users, an attacker who tries to intrude later can perform pseudo-login with a number of password attempts equal to or less than the threshold Nu. For this reason, it is necessary to clear the value of the counter 114 for all users.
[0033]
As a method of dealing with a plurality of attackers described above, it is conceivable to prepare a counter 114 for each attacker. In general, it is difficult to determine whether multiple attacks on a computer system are attacks by the same person or attacks by different persons. As an example of a discrimination method, an attack made from the same IP address is used. There are a method that considers an attack from the same person, and a method that regards an attack made at the same time as an attack from the same person.
[0034]
Also, it is assumed that the attacker side attacks a plurality of attackers at the same time using different IDs at the same time (group attack). In order to cope with this, a counter common to each user is prepared in the counter 114, the number of illegal passwords input by a plurality of attackers within a certain time is counted by the counter, and the count value reaches a predetermined value. In this case, it is determined that the attack is a group attack, and login to the fake server 130 is permitted. Alternatively, the computer system 100 is locked out for a certain period.
[0035]
Next, the behavior monitoring of the attacker after the pseudo login in Step 711 of FIG. 7 will be described in detail. FIG. 13 is a flowchart showing processing for monitoring the behavior of the attacker after the pseudo login.
[0036]
An attacker who has made a pseudo login inputs a command to the server 120 of the computer system 100 from the input unit 151 of the client 150 (step 1301). When a command is input, the client control unit 152 transmits the command to the computer system 100 (step 1302).
[0037]
In the computer system 100, when a command is received from the client 150 via the network 140, the gateway control unit 111 analyzes the command, and an action to be performed by an attacker according to the command is stored in the restricted action pattern storage unit 115. It is compared whether or not it matches the stored restricted action pattern (step 1303).
[0038]
FIG. 14 is a diagram illustrating an example of the restricted action pattern stored in the restricted action pattern storage unit 115. In the example shown in FIG. 14, as the restricted action patterns, 1401 “attempts to become a privileged user” and 1402 “attempts to log in to another computer”, etc., against the attacker in the fake server 130. There are patterns of behaviors that place restrictions. The restricted action pattern is set according to the security policy in the computer system 100.
[0039]
FIG. 15 is a diagram illustrating an example of the restricted action pattern match determination in step 1303 of FIG. In the example illustrated in FIG. 15, when the gateway control unit 111 receives a command “su”, the gateway control unit 111 analyzes the command, and in the restricted action pattern illustrated in FIG. Judged to match.
[0040]
Returning to FIG. 13, in step 1303, when the restriction action pattern matches, the gateway control unit 111 returns a command failure response corresponding to the command to the client 150 without relaying the input command to the fake server 130. . When the client 150 receives a command failure response via the network 140, the client control unit 152 displays a command failure screen on the display unit 153 based on the command failure response (step 1304).
[0041]
FIG. 16 is a diagram showing an example of a command failure screen in step 1304 when it matches the “becoming a privileged user” 1401 of the restricted action pattern in FIG. 14 in step 1303. The example shown in FIG. 16 shows a situation in which an attacker has entered a command and a password to become a privileged user but failed to become the privileged user.
[0042]
In the computer system 100 according to the present embodiment, it is prohibited that the user directly logs in by inputting the user ID and password of the privileged user from the client 150 in the remote place.
[0043]
FIG. 17 is a diagram showing an example of a command failure screen in step 1304 in the case where the restricted action pattern in FIG. 14 matches the “attempt to log in to another computer” 1402 in step 1303. The example shown in FIG. 17 shows a situation in which an attacker enters a command to log in to another computer, but does not return any response. As shown in FIG. 17, depending on the command input by the attacker, no response may be returned to the client 150. That is, the command failure response in step 1304 includes the case where the gateway control unit 111 does not return any response to the client 150.
[0044]
Returning to FIG. 13 again, if it is determined in step 1303 that the restriction action pattern does not match, the gateway control unit 111 relays the received command to the fake server 130 (step 1305).
As described above, the computer system 100 allows an attacker to perform a pseudo login and freely use various data and application programs provided by the fake server 130 without touching the restricted action pattern. Let Since important information in the computer system 100 is stored in the server 120 and a restricted action pattern according to the security policy in the computer system 100 is set, an attack in which the computer system 100 causes a pseudo login Will not be fatally damaged by a person.
[0045]
An attacker who believes that the intrusion has succeeded may attempt to intrude into the computer system 100 again using the same user ID and password used during the previous attack. In that case, the computer system 100 causes the attacker to perform pseudo login again via steps 703 to 711 in FIG. However, the attacker may eventually realize that the computer he or she is invading is not the attack target server 120, and may once log out and change the user ID and password again to launch a brute force attack. At that time, the threshold value Nu used for the pseudo login and the contents of the false information stored in the false server 130 are changed. Further, the contents of the pseudo login information stored in the pseudo login information storage unit 116 are erased so that the pseudo login cannot be performed again with the user ID and password at the previous pseudo login.
[0046]
If the threshold value Nu is not changed, the attacker logs in with the same number of password attempts as the previous time, and it is easily determined that the user has been pseudo-logged in. Another problem is that pseudo login can be made again with the user ID and password at the previous pseudo login. The attacker can browse the fake information in the fake server 130 either by pseudo login by entering Nu passwords or by pseudo login by entering the password at the previous pseudo login. By trying both attacks, the attacker can confirm that the information in the login computer has the same contents in either case, so that it is also found that pseudo login is performed. If the contents of the false information are changed by changing the threshold Nu and the user ID and password at the previous pseudo-login cannot be used again, the attacker who has pseudo-logged in the fake server 130 again falls into suspicion, It can be expected that the computer on which the user has logged in is not sure whether the computer is the real server 120. In this way, it is possible to gain time until the password is solved for an attacker who performs a brute force attack of the password.
[0047]
Although one embodiment of the present invention has been described above, the pseudo login system of the present invention can be used in combination with a conventional lockout system. When used in combination, the attacker will need more time to unlock the password for the time required for pseudo-login or lockout than when either method is used alone. For this reason, it is considered that the computer system becomes safer.
[0048]
【The invention's effect】
As described above, according to the present invention, an attacker who tries to use a computer system illegally increases the time until the password is solved by a brute force attack, and a legitimate user prevents the attacker from attacking. The computer system can be used without being used.
[Brief description of the drawings]
FIG. 1 is a block diagram of a system configuration according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of pseudo login information stored in a pseudo login information storage unit of FIG. 1;
FIG. 3 is a diagram illustrating an example of information stored in the server of FIG. 1;
FIG. 4 is a diagram illustrating an example of false information stored in a false server 130 of FIG.
FIG. 5 is an overall flowchart of a login process according to an embodiment of the present invention.
6 is a diagram showing an example of a login screen in step 505 of FIG.
FIG. 7 is a flowchart showing details of step 509 in FIG. 5;
8 is a diagram showing an example of a successful login screen in step 707 of FIG.
9 is a diagram illustrating an example of an erroneous input pattern stored in an erroneous input pattern storage unit 113 of FIG. 1;
10 is a diagram illustrating an example of erroneous input pattern matching determination in step 704 of FIG. 7;
11 is a diagram showing an example of a login failure screen in step 708 of FIG.
12 is a diagram showing an example of a pseudo login screen in step 711 of FIG.
13 is a flowchart showing an attacker behavior monitoring process after pseudo login in Step 711 of FIG. 7;
14 is a diagram illustrating an example of a restricted action pattern stored in a restricted action pattern storage unit 115 in FIG. 1. FIG.
15 is a diagram showing an example of a restricted action pattern match determination in step 1303 of FIG.
FIG. 16 is a diagram showing an example of a command failure screen in step 1304 of FIG.
17 is a diagram showing another example of the command failure screen in step 1304 of FIG.
[Explanation of symbols]
100 computer system
110 gateway
111 Gateway control unit
112 Password storage
113 Error input pattern storage
114 counter
115 Prohibited behavior pattern storage
116 Pseudo login information storage
120 servers
130 Fake server
140 network
150 clients
151 Input section
152 Client control unit
153 Display

Claims (4)

Authenticates the entered user-specific identification information and a password, Oite the computer system to allow login to the authorized user, a fraudulent login defense of the computer system to perform,
Analyzes the entered identification information and password to determine whether the password is entered by an attacker who attempts to use the computer system illegally.
Counts the number of passwords entered by the attacker, and when the number of times the input reaches a predetermined value, allows the attacker to log in fake and stores the identification information and password entered by the attacker Clear the count of passwords entered by attackers,
Thereafter, when the input identification information and password match the stored identification information and password, a fake login is immediately permitted.
A method for preventing unauthorized login of a computer system. The method for preventing unauthorized login of a computer system according to claim 1,
Counting the number of passwords entered by a plurality of attackers within a predetermined time, and allowing the fake login to each attacker when the number of inputs reaches a predetermined value.
A method for preventing unauthorized login of a computer system. In a computer system that authenticates the input user-specific identification information and password and allows a legitimate user to log in,
A first server that stores various useful information and provides various application programs;
A second server that stores useless fake information resembling the information stored in the first server and provides various application programs;
First storage means for storing a password of a user authorized to use a computer system in association with identification information;
Second storage means for storing identification information and a password of a user permitted to use the second server;
Third storage means for storing an input error pattern assumed when the user inputs a password;
Means for referring to the first storage means and permitting the user who has input the identification information and password to use the first server when the input identification information and password are valid. When,
When the input identification information and password are not valid, are not stored in the second storage means, and the input password does not match the input error pattern of the third storage means Means for determining that the input password is a password input by an attacker who intends to illegally use the computer system;
Means for counting the number of times a password is input by an attacker who attempts to use the computer system illegally;
When the password input count reaches a predetermined value, the attacker is allowed to use the second server, and the input identification information and password are stored in the second storage means. Means to remember and clear all counts of password input by attackers,
If the input identification information and password are not valid and are stored in the second storage means, the user who has input the identification information and password is regarded as an attacker, and the second information is immediately entered. Means to allow the server to be used;
A computer system comprising: The computer system according to claim 3.
Means for storing an action pattern that restricts an attacker using the second server;
A means for restricting the attacker's action when the attacker's action matches the restriction action pattern;
A computer system comprising:

Images