JP5736689B2 - Security management system and security management method - Google Patents

Description

  The present invention relates to a security management system for detecting a security attack on an offline device such as an IC card.

  In recent years, in order to start an information processing apparatus safely, a mechanism has been proposed in which an IC card, a USB device, or the like is used as a security token, and the apparatus is started after user authentication or system verification. Here, the security token is data that can be stored secretly and can be attached to and detached from the device. IC cards, SIM (Subscriber Identity Module), USIM (Universal Subscriber Identity Module), which are widely used for employee ID cards, Mini SIM, USB memory, etc. are included. Hereinafter, these IC cards and USB devices are called offline devices.

For example, Patent Document 1 provides an example in which a USB compatible storage device is used as a security token for storing an encryption key.
Patent Document 2 discloses a SIM holder that has a USB connector and is detachably mounted on a SIM. The IC chip converts an ISO7816 interface (SIM interface) into a USB interface inside the SIM holder. In addition, an antenna coil for non-contact communication, a contact terminal plate that can be electrically connected to a mounted SIM, and the like are described. If the SIM holder shown in Patent Document 2 is equipped with a SIM in which personal authentication data is written and is carried, it can be used as a non-contact ID module when entering a non-contact magnetic field such as a door gate or a ticket gate. In addition, it can be used as a USB interface ID module by connecting to a USB connector of a PC (paragraph [0049] of Patent Document 2).

  By the way, as a method for authenticating an individual, for example, PIN (Personal Identification Number) authentication is generally known. In PIN authentication, PIN authentication information such as a four-digit number is stored in the above-mentioned offline device, and the PIN authentication information is collated with the PIN code input via the interface of the information processing terminal. Authentication is performed. If the verification fails beyond the allowable number of consecutive failures, the PIN authentication information stored in the offline device is disabled to protect the device or device. Yes.

Special table 2010-517424 JP 2004-118771 A

  However, since the above-described security token (offline device) is separate from the device, if the offline device itself is stolen, it is assumed that it will be used illegally by an attacker. In many systems that perform PIN authentication, once a valid user succeeds in authentication, the number of failures is cleared. For this reason, even if the attacker illegally tries to guess the PIN code until just before the allowable number of consecutive failures is reached, once the legitimate user succeeds in authentication, the number of authentication failures is cleared. I can't leave a trace. Therefore, a legitimate user is unaware of the device being used by the attacker, and if the attacker repeats such illegal guessing attempts every day, the attacker will eventually find the correct PIN. Is also possible.

  Even if a user with a legitimate authority legitimately succeeds in PIN authentication and unlocks the security lock, if the user has malicious intent, he / she performs an illegal operation on the offline device or system. It will be allowed.

The present invention has been made in view of such problems, and the object of the present invention is to detect unauthorized operations and security attacks on offline devices and to allow the user and administrator to grasp the history. it is to provide a security management system and security management how.

In order to solve the above-described problem, the first invention performs an authentication process using the authentication information between a security token storing authentication information and an information processing terminal capable of communication connection with the security token. In the security management system to perform, the security token includes an authentication process execution unit that executes an authentication process based on the authentication information, and an error response unit that returns an error response to the information processing terminal when the authentication process fails in the authentication process When an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. In case of failure, an authentication failure log is generated, and the corresponding security is returned before returning the error response. Log recording means for recording in a predetermined storage area in the token, and the information processing terminal requests the security token to upload the log when the authentication process is successful. Log analysis means for determining whether or not the security token is illegally used based on a log uploaded from the security token in response to the request, and the security token is illegally used by the log analysis means When it is determined that there is a possibility that the log token has been analyzed, an analysis result processing means for notifying the result of log analysis or requesting to restrict the use of the security token and when the operation is performed on the security token Generate an operation log and record the generated log in the security token. A security management system, characterized in that it comprises, a write request means along with the log write request command transmitted to the security token for causing.
According to a second aspect of the present invention, there is provided a security management system for performing an authentication process using the authentication information between a security token storing the authentication information and an information processing terminal capable of communication connection with the security token. The security token includes: an authentication process executing unit that executes an authentication process based on the authentication information; an error response unit that returns an error response to the information processing terminal if authentication fails in the authentication process; and the security token When an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authentication is performed when authentication fails with the security token. A failure log is generated, and the predetermined token in the security token is returned before returning the error response. Log recording means for recording in a storage area, and when the authentication process is successful, the information processing terminal responds to the request, log upload request means for requesting the security token to upload the log There is a possibility that the security token is illegally used by the log analysis means for determining whether or not the security token is illegally used based on the log uploaded from the security token. Analysis result processing means for notifying the result of log analysis or requesting to restrict the use of the security token, the security token is in a communication state with the information processing terminal. And a communication monitoring program for monitoring command operations. When the communication token enters a communication state, the communication monitoring program is started, the command operation performed on the security token is constantly monitored, and the input command is written as log data in the predetermined storage area. It is a security management system.

Here, the security token is a device that has a communication function with an information processing terminal, a memory function, and an information processing function, and is configured separately from the information processing terminal. For example, an IC card, a USB memory, a memory card, and the like are included.

According to the security management system of the first invention, the security token executes an authentication process based on the stored authentication information, and returns an error response to the information processing terminal when the authentication process fails in the authentication process. . Also, when an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. If it fails, an authentication failure log is generated and recorded in a predetermined storage area in the security token before returning the error response. When the authentication process is successful, the information processing terminal requests the security token to upload the log, and in response to the request, the security token is invalidated based on the log uploaded from the security token. Determine whether it has been used. When it is determined that there is a possibility that the security token has been used illegally, the result of log analysis is notified or the use of the security token is restricted. The information processing terminal generates an operation log when an operation is performed on the security token, and transmits the generated log to the security token together with a log write request command for recording the generated log in the security token.
According to the security management system of the second invention, the security token executes an authentication process based on the stored authentication information, and if the authentication process fails, an error response is sent to the information processing terminal. return it. Also, when an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. If it fails, an authentication failure log is generated and recorded in a predetermined storage area in the security token before returning the error response. When the authentication process is successful, the information processing terminal requests the security token to upload the log, and in response to the request, the security token is invalidated based on the log uploaded from the security token. Determine whether it has been used. When it is determined that there is a possibility that the security token has been used illegally, the result of log analysis is notified or the use of the security token is restricted. The security token holds a communication monitoring program for monitoring a communication state with the information processing terminal and a command operation. When the security token is in a communication state, the communication token is started, and The command operation performed is monitored, and the input command is written as log data in the predetermined storage area.

Thus, the log of the operation made to the security token is generated by the security token side, since they are forcibly recorded in a predetermined storage area in the security token, the attacker, other users or by the administrator, An operation history can be kept. In addition, when authentication failure occurs with the security token, an authentication failure log is generated on the security token side and recorded in a predetermined storage area in the security token before returning the error response. Even when an operation for extracting a security token is performed at the moment of receiving an error response from the security token, a log is already recorded in the security token. And, in the case of a successful authentication, or the analysis is uploaded to the log is forced to information processing terminal in the security token, if there is an unauthorized use has been the history (log), the fact is notified, security Since the use of tokens is restricted, users and administrators can know the history of operations from the previous successful authentication to the current successful authentication, or can protect security tokens and systems . Since the log is stored in the security token , a trace can be left even if operated from any information processing terminal.

The log analysis means may be realized by software or the like executed in the information processing terminal, or a log analysis included in an external log server that can be connected to the information processing terminal via a network or the like You may make it utilize a function.
In addition, whether or not the information is illegally used is determined, for example, when the number of authentication failures is large or when a part of authentication information input from the information processing terminal is changed regularly or continuously. Is considered an unauthorized authentication attempt from an unauthorized user. Alternatively, a case where many commands exceeding the user's authority range are input may be included in unauthorized use.

In the security management system of the first or second invention, it is preferable that the log recorded in the log recording unit includes an authentication trial operation log.
As a result, the log that the attacker attempted to guess the authentication is stored in the security token, and when a legitimate user succeeds in the authentication, the log is forcibly uploaded and analyzed. For this reason, a legitimate user can confirm that an attacker has attempted an authentication guess.

In the security management system of the first or second invention, it is desirable that the log recorded in the log recording unit includes a log of operations performed on the security token after successful authentication.
As a result, when there is a trace of illegal internal analysis, it is regarded as a malicious attack from a user with a legitimate authority, and the system can be protected by disabling the security token.

According to a third aspect of the present invention, there is provided a security management method for performing an authentication process using the authentication information between a security token storing authentication information and an information processing terminal capable of communication connection with the security token. A security token performing an authentication process based on the authentication information; if the security token fails authentication in the authentication process; returning an error response to the information processing terminal; When an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authentication fails with the security token. In this case, an authentication failure log is generated and the error response is returned before returning. Recording in a predetermined storage area in the security token, and requesting the information processing terminal to upload the log to the security token when the authentication process is successful, in response to the request Based on a log uploaded from the security token, the information processing terminal or an external server determines whether the security token has been used illegally, and the possibility that the security token has been used illegally The information processing terminal or the server notifies the result of the log analysis or requests to restrict the use of the security token, and the information processing terminal Generate operation logs when operations are performed on tokens A security management method, which comprises carrying out the steps of the generated log with the log write request command for recording to said security token to send to said security token, the process comprising.
According to a fourth aspect of the present invention, there is provided a security management method for performing an authentication process using the authentication information between a security token storing authentication information and an information processing terminal capable of communication connection with the security token. The security token executing an authentication process based on the authentication information; the security token returning an error response to the information processing terminal if the authentication token fails in the authentication process; and the security token However, when an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. If it fails, an authentication failure log is generated and the error response is returned. A step of recording in a predetermined storage area in the security token, a step of requesting the information processing terminal to upload the log to the security token when the authentication process is successful, and a response to the request Then, based on the log uploaded from the security token, the information processing terminal or an external server determines whether the security token has been used illegally, and the security token has been used illegally If it is determined that there is a possibility, the information processing terminal or the server notifies the result of the log analysis or requests to restrict the use of the security token, The security token includes a communication state with the information processing terminal and A communication monitoring program for monitoring command operations is held, and when the security token enters a communication state, the communication monitoring program is activated, and command operations performed on the security token are always monitored, and input commands are logged. In the security management method, the data is written in the predetermined storage area.

According to the third invention, the security token executes an authentication process based on the stored authentication information, and returns an error response to the information processing terminal if the authentication process fails in the authentication process. Also, when an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. If it fails, an authentication failure log is generated and recorded in a predetermined storage area in the security token before returning the error response. When the authentication process is successful, the information processing terminal requests the security token to upload the log, and in response to the request, the security token is invalidated based on the log uploaded from the security token. It is determined whether or not the security token has been used. If it is determined that the security token may have been used illegally, the result of log analysis is notified or the use of the security token is restricted. . The information processing terminal generates an operation log when an operation is performed on the security token, and transmits the generated log to the security token together with a log write request command for recording the generated log in the security token.
According to the fourth invention, the security token executes an authentication process based on the stored authentication information, and returns an error response to the information processing terminal when the authentication process fails in the authentication process. Also, when an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authenticated by the security token. If it fails, an authentication failure log is generated and recorded in a predetermined storage area in the security token before returning the error response. When the authentication process is successful, the information processing terminal requests the security token to upload the log, and in response to the request, the security token is invalidated based on the log uploaded from the security token. Determine whether it has been used. When it is determined that there is a possibility that the security token has been used illegally, the result of log analysis is notified or the use of the security token is restricted. The security token holds a communication monitoring program for monitoring a communication state with the information processing terminal and a command operation. When the security token is in a communication state, the communication token is started, and The command operation performed is monitored, and the input command is written as log data in the predetermined storage area.

Thus, the log of the operation made to the security token is generated by the security token side, since they are forcibly recorded in a predetermined storage area in the security token, the attacker, other users or by the administrator, An operation history can be kept. In addition, when authentication failure occurs with the security token, an authentication failure log is generated on the security token side and recorded in a predetermined storage area in the security token before returning the error response. Even when an operation for extracting a security token is performed at the moment of receiving an error response from the security token, a log is already recorded in the security token. And, in the case of a successful authentication, or the analysis is uploaded to the log is forced to information processing terminal in the security token, if there is an unauthorized use has been the history (log), the fact is notified, security Since the use of tokens is restricted, users and administrators can know the history of operations from the previous successful authentication to the current successful authentication, or can protect security tokens and systems . Since the log is stored in the security token , a trace can be left even if operated from any information processing terminal.

According to the present invention, to detect unauthorized operations or security attacks on offline devices can provide security management system and security management how capable of grasping the user or administrator.

1 is an overall configuration diagram of a security management system 1 according to the present invention. Block diagram showing the internal configuration of the offline device (IC card 2) The block diagram which shows the internal structure of the information processing terminal 3 In the present invention, (A) a mode in which log analysis is performed by the log server 5 and (B) a mode in which log analysis is performed by the information processing terminal 3 The sequence diagram which shows operation | movement of each part of the security management system 1 of this invention The flowchart explaining the flow of the process performed in the information processing terminal 3 The figure which shows the structure of the log data uploaded to the log server 5

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.
First, the configuration of the present invention will be described with reference to FIGS.

FIG. 1 is a diagram showing a system configuration of a security management system 1 according to the present invention.
As shown in FIG. 1, the security management system 1 includes an IC card 2 (offline device), an information processing terminal 3, and a log server 5. The log server 5 is communicatively connected to the information processing terminal 3 via the network 9. Alternatively, the information processing terminal 3 may function as the log server 5.
An IC card reader / writer 4 is connected to the information processing terminal 3, and data communication between the IC card 2 and the information processing terminal 3 is performed using the IC card reader / writer 4.

  In the present embodiment, it is assumed that the IC card 2 is used as an offline device capable of communication connection with the information processing terminal 3. The IC card 2 that is an offline device is used as a security token for using the information processing terminal 3. The security token is a device that stores authentication information in a secret manner in order to start the information processing terminal 3 safely. The IC card 2 includes an IC card, SIM (Subscriber Identity Module), USIM (Universal Subscriber Identity Module), mini-SIM, and the like that are widely used for employee ID cards. Further, instead of the IC card 2, a device such as a USB memory or a memory card that is detachable from the information processing terminal 3 may be used. The offline device referred to in the present invention is configured separately from the information processing terminal 3 like the above-described IC cards, USB memory, and memory card, and has a communication function and a memory function with the information processing terminal 3. And a device having an information processing function.

Here, the internal structure of the IC card 2 is shown in FIG.
2, the IC card 2 includes a CPU (Central Processing Unit) 21, a RAM (Random Access Memory) 22, an EEPROM (Electrically Erasable Programmable Read Only Memory) 23, an I / F 24, and the like. .

The CPU 21 calls a program stored in the EEPROM 23 to a work memory area on the RAM 22 and executes it.
The RAM 22 temporarily stores the loaded program and data, and includes a work area used by the CPU 21 to perform various processes.

The EEPROM 23 is a rewritable memory, and holds a program executed by the CPU 201 of the IC card 2, authentication information 23a necessary for authentication processing, and the like. The authentication information is, for example, PIN authentication information or biometric authentication information. In addition to the above-described programs and information, a log 23b of operations performed on the IC card 2 is held.
The I / F 24 receives a signal transmitted from the information processing terminal 3 side based on the ISO 7816 standard, which is an IC card interface, or transmits a signal to the information processing terminal 3 side, such as a UART (Universal Asynchronous Receiver Transmitter). Consists of.

  The information processing terminal 3 is a personal computer (PC_A, PC_B), ATM (automated teller machine), portable terminal, game machine, or other information that can be connected to an offline device (IC card 2 in FIG. 1). Includes processing equipment.

Here, the internal configuration of the information processing terminal 3 is shown in FIG.
As shown in FIG. 3, the information processing terminal 3 includes a control unit 11, a storage unit 12, a media input / output unit 13, a communication control unit 14, an input unit 15, a display unit 16, a peripheral device I / F unit 17, and the like. It is configured to be connected via a bus 18.

The control unit 11 includes a CPU, a ROM (Read Only Memory), a RAM, and the like.
The CPU calls a program stored in the storage unit 12, ROM, recording medium or the like to a work memory area on the RAM and executes it, and drives and controls each unit connected via the bus 18. The ROM permanently holds a computer boot program, a program such as BIOS, data, and the like. The RAM temporarily holds the loaded program and data, and includes a work area used by the control unit 11 to perform various processes.

  The storage unit 12 is an HDD (hard disk drive), and stores a program executed by the control unit 11, data necessary for program execution, an OS (operating system), and the like. These program codes are read by the control unit 11 as necessary, transferred to the RAM, and read and executed by the CPU.

The media input / output unit 13 is a media input / output device such as an HD (hard disk) drive, floppy (registered trademark) disk drive, memory card drive, PD drive, CD drive, DVD drive, or MO drive. Output.
The communication control unit 14 includes a communication control device, a communication port, and the like, and is a communication interface that mediates communication with the network 9 and performs communication control.

The input unit 15 is an input device such as a keyboard, a pointing device such as a mouse, or a numeric keypad, and outputs input data to the control unit 11.
The display unit 16 includes a display device such as a liquid crystal panel or a CRT monitor, and a logic circuit (video adapter or the like) for executing display processing in cooperation with the display device, and is input under the control of the control unit 11. Display information is displayed on a display device.

The peripheral device I / F (interface) unit 17 is a port for connecting a peripheral device to the information processing terminal 3. The information processing terminal 3 transmits and receives data to and from the peripheral device via the peripheral device I / F unit 17. I do. The peripheral device I / F unit 17 is configured by USB, IEEE 1394, RS-232C, or the like. The IC card reader / writer 4 is connected to the peripheral device I / F unit 17.
The bus 18 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

Next, the basic operation of communication between the IC card 2 and the information processing terminal 3 will be described.
When communication is started between the IC card 2 and the information processing terminal 3 via the IC card reader / writer 4, a command (processing request) is transmitted from the information processing terminal 3 to the IC card 2. Further, a response is transmitted from the IC card 2 to the information processing terminal 3 in response to a command from the information processing terminal 3. The CPU 21 of the IC card 2 executes processing according to the received command, generates a response according to the processing result, and transmits it to the IC card reader / writer 4 of the information processing terminal 3 via the I / F 24.

In the present embodiment, it is assumed that the PIN authentication process is executed when the use of the IC card 2 is started.
PIN authentication is an authentication method using a PIN code for identifying the user. When the user holds the IC card 2 over the IC card reader / writer 4 of the information processing terminal 3 or inserts it, the control unit 11 of the information processing terminal 3 displays a PIN code input screen on the display unit 16 and displays the PIN code. Accept input. When the PIN code is input by the user, the control unit 11 of the information processing terminal 3 transmits an authentication request command for the input PIN code to the IC card 2. The CPU 21 of the IC card 2 compares the input PIN code with the authentication information 23a stored in the EEPROM 23, and if they match, sends a response of authentication success to the information processing terminal 3 if they do not match. To do.

In PIN authentication, an allowable number of consecutive failures can be set in advance. If the authentication fails beyond this number, the authentication information 23a stored in the EEPROM 23 of the IC card 2 can be invalidated. The use of the functions of the IC card 2 can be restricted, such as blocking all or part of the functions of the IC card 2.
When the PIN authentication is successful, the function of the IC card 2 and the function of the information processing terminal 3 can be used.

In the security management system 1 that performs the basic operation as described above, in the present invention, when any command is given from the information processing terminal 3 to the IC card 2, a log 23b of the operation is recorded in the EEPROM 23 of the IC card 2. Shall be.
The log recorded in the IC card 2 includes, for example, a PIN authentication request command and a processing request command transmitted from the information processing terminal 3 to the IC card 2 after successful authentication.

When the PIN authentication is successful, the log 23b stored in the EEPROM 23 of the IC card 2 is uploaded to the information processing terminal 3 and the log analysis is performed.
For example, as shown in FIG. 4A, the log analysis is uploaded to the log server 5 via the information processing terminal 3 and performed in the log server 5. Alternatively, as shown in FIG. 4B, the log analysis function of the log server 5 may be provided in the information processing terminal 3. In this case, the information processing terminal 3 has log analysis software, and the control unit 11 executes the log analysis software. In the case of FIG. 4B, it is not necessary to upload log data to the log server 5.

  In log analysis, the log server 5 or the information processing terminal 3 analyzes whether the IC card 2 is used illegally based on the log 23b acquired from the IC card 2, and determines whether or not to permit the use of the card. A determination is made and a response indicating whether or not the information is usable is transmitted to the information processing terminal 3. When the information processing terminal 3 obtains a “unusable” response, the information processing terminal 3 notifies the user or the manager or transmits a request for restricting the use to the IC card 2. When the response “available” is obtained, the security lock of the IC card 2 is released so that the function of the IC card 2 can be used.

  FIG. 4A shows the flow of log data when the log server 5 is provided separately from the information processing terminal 3 as in the system configuration of FIG. The log data to be analyzed is uploaded to the log server 5. Usually, since the IC card 2 itself does not have a function of directly communicating with the log server 5, log data is uploaded to the log server 5 via the communication control unit 14 of the information processing terminal 3.

When the log server 5 is provided separately from the information processing terminal 3 as shown in FIG. 4A, the log server 5 is used in a plurality of information processing terminals 3 (PC_A, PC_B, ATM, etc.) which are client terminals. Since log data can be collected from the IC card 2, detailed log analysis can be performed, and the accuracy of the usability determination is improved.
On the other hand, when a log analysis function is provided in the information processing terminal 3 as shown in FIG. 4B, log analysis can be easily performed in a local use environment without requiring access to the log server 3. This security management system 1 can be configured simply.

Next, the operation of the security management system 1 in the present embodiment will be described with reference to FIGS.
FIG. 5 is a sequence diagram showing the operation of each part of the security management system 1, and FIG. 6 is a flowchart for explaining the flow of processing executed by the information processing terminal 3. FIG. 7 is a diagram illustrating a data configuration of the log data 10 uploaded from the IC card 2 to the log server 5.

In the following example, it is assumed that an attacker without a legitimate authority tries to guess a likely PIN code in order to use another person's IC card 2 without permission.
In FIG. 5, PC_A is an information processing terminal 3 used by a legitimate user who is authorized for the IC card 2, and PC_B is an information processing terminal 3 used by an unauthorized user. Here, the maximum number of trials of PIN authentication is three, and the allowable number of remaining trials is recorded on the IC card 2 side. That is, every time authentication fails, the number of remaining attempts is decremented by one and recorded.

  The information processing terminal 3 (PC_A, PC_B) used by each user has a program for executing a process for using PIN authentication or the function of the IC card 2 at least with the IC card 2, It is assumed that the control unit 11 of the information processing terminal 3 executes the PIN authentication process of the IC card 2 and other processes based on this program. For example, a PIN code input screen, a processing request (command) input screen, a response (response) display screen, etc. in the information processing terminal 3 are provided by this program.

  For example, as shown in FIG. 5, when an attacker takes out another person's IC card 2, inserts it into the IC card reader / writer 4 of the information processing terminal 3 (PC_B), and guesses and inputs the PIN code, CPU21 performs PIN collation processing (Step S1). In the PIN verification process, the CPU 21 of the IC card 2 determines whether the authentication information 23a stored in the IC card 2 matches the input PIN code, and if it does not match, there is an authentication request as a verification failure. A log 23b indicating this is generated and stored in the EEPROM 23 (step S2). Also, an error response is sent to the information processing terminal 3 (PC_B). The log 23b may be a data string including, for example, an input PIN code and an error code (such as an error code based on ISO7816). When time information or the like is acquired from the information processing terminal 3 (PC_B), time information may be added to the log 23b. The CPU 21 of the IC card 2 subtracts 1 from the number of remaining trials whenever authentication fails.

  It is assumed that such PIN estimation trials are continuously performed until the allowable number of times is not reached (the remaining number of trials is “1”). The CPU 21 of the IC card 2 writes a log 23b indicating that an authentication request has been made in the EEPROM 23 (steps S3 to S4).

  Data is normally written to the IC card 2 in accordance with a command (request) from the information processing terminal 3 to the IC card 2. However, in the present invention, since it is assumed that the information processing terminal 3 using the IC card 2 includes a computer or the like used by an attacker, the log data is forcibly stored on the IC card 2 side. It is assumed that data is written in a storage area (for example, EEPROM 23). That is, when the authentication fails in the IC card 2, the CPU 21 of the IC card 2 generates the log and writes it in a predetermined storage area (for example, EEPROM 23) of the IC card 2.

For this reason, for example, in the PIN verification processing program stored in the ROM 22 or the EEPROM 23 of the IC card 2, a process for writing the log 23 b to the EEPROM 23 when PIN authentication fails may be incorporated.
Thus, if the log is forcibly written on the IC card 2 side, it is preferable that the log can be reliably left in the IC card 2 immediately after the authentication error. For example, even when the information processing terminal 3 receives an error response from the IC card 2 and performs an operation for extracting the card, the log is already recorded in the IC card 2, so that the log analysis in the latter stage is performed. (Step S7) can be performed reliably.

  However, when a device having no arithmetic processing function is adopted as an offline device, data may be written in accordance with a command (request) from the information processing terminal 3. That is, a communication monitoring program is installed in the EEPROM 23 of the offline device, and when the offline device is activated (in a communication state), the CPU 21 of the offline device starts this monitoring program and constantly monitors command operations from the outside. The input command may be written in the EEPROM 23 as log data. In this case, if the information processing terminal 3 (PC_B) that has received the authentication error response generates the log 23b and transmits it to the offline device together with the write request command, the log 23b can be written to the offline device. .

  Processing executed on the information processing terminal 3 side in steps S1 to S4 will be described with reference to FIG.

  As illustrated in FIG. 6, when the information processing terminal 3 (PC_B) starts communication with the IC card 2 (step S <b> 21), the information processing terminal 3 (PC_B) acquires information on the number of remaining PIN authentication attempts from the IC card 2. If the number of remaining trials is not “0” (step S22; No), the PIN authentication screen is displayed on the display screen of the information processing terminal 3 (PC_B) (step S23), and the input of the PIN code is accepted (step S24). The information processing terminal 3 (PC_B) transmits an authentication request command together with the PIN code (step S25). At this time, the current time information may be added and transmitted.

The entered PIN code is collated on the IC card 2 side, and a response of the collation result is acquired (step S26). The response includes the number of remaining attempts.
If a response indicating that the authentication has failed is received from the IC card 2 (step S27; failure), the process returns to step S22 to determine the number of remaining attempts included in the response. If the number of remaining trials is not “0” (step S22; No), the PIN authentication screen is displayed again (step S23), and the PIN code and the authentication request command input on the PIN authentication screen are transmitted to the IC card 2. (Step S24, Step S25).
In step S22, when the number of remaining trials included in the response reaches “0” (step S22; Yes), an error screen is displayed (step S28), and the process ends. In the EEPROM 23 of the IC card 2, a log 23b including an input PIN and an error code is written.

  If the authentication succeeds before the remaining number of trials becomes “0” (step S22; No → step S23 to step S27; success), the information processing terminal 3 acquires a log from the IC card 2 (step S29).

Returning to the description of step S5 in FIG.
An attacker has made a PIN guessing attempt, but the PIN guessing attempt is interrupted within an allowable number of times, and then a valid user (PC_A) uses the IC card 2 to succeed in PIN authentication (step S5). ).

At this stage, the CPU 21 of the IC card 2 forcibly uploads the log 23b stored in the EEPROM 23 of the IC card 2 to the log server 5 in addition to the response of the authentication success. The information processing terminal 3 (PC_A) uploads the log 23b received from the IC card 2 to the log server 5 (step S6). When receiving the log 23b (log data 10) of the IC card 2, the log server 5 stores the log 23b in the storage area in the log server 5, performs log analysis, and determines whether the IC card 2 can be used (step S7). ).
The result of log analysis by the log server 5 is transmitted to the information processing terminal 3 (PC_A). The information processing terminal 3 (PC_A) performs processing in accordance with the availability received from the log server 5 (step S8).

  If the log server 5 determines that the IC card 2 can be used, the information processing terminal 3 releases the security lock of the IC card 2 and permits the use of the IC card 2 (step S9). When it is determined that the log server 5 cannot use the information processing terminal 3, the information processing terminal 3 restricts the use of the IC card 2 by, for example, disabling the authentication information registered in the EEPROM 23 of the IC card 2.

Processing performed by the information processing terminal 3 (PC_A) at each stage from authentication success (step S5 in FIG. 5) to log analysis result response (step S9 in FIG. 5) will be described with reference to FIG.
When the authentication result is acquired in step S26 of FIG. 6 and the PIN authentication is successful (step S27; success), when the log 23b is acquired from the IC card 2 (step S29), the control unit 11 of the information processing terminal 3 In order to prevent falsification, the log data 10 with the electronic signature 103 and the verification code 104 added to the log 23b is generated (step S30) and uploaded to the log server 5 (step S31).
Alternatively, an electronic signature or verification code may be added in advance in the IC card 2, and the information processing terminal 3 may upload a log to which the electronic signature or verification code has been added and transmit it to the log server 5.

FIG. 7 illustrates an example of log data 10 uploaded to the log server 5.
The log data 10 includes all logs 23b performed on the IC card 2 from the previous successful PIN authentication to the current successful PIN authentication.
For example, logs (error PINs) R1 and R2 determined to be authentication errors, and command operation logs R3 and R4 performed on the IC card 2 after successful PIN authentication (recorded in steps S11 and S13 described later) Log) and the like are uploaded to the log server 5.
By adding the electronic signature 103 and the verification code 104 to the log data 10 uploaded to the log server 5, it is possible to prevent data leakage or falsification when uploading to the log server 5.

  In the log analysis processing in step S7 of FIG. 5, whether the log server 5 has been illegally operated on the IC card 2 based on the acquired log data 10 or past log data related to the log data 10. Whether or not the IC card 2 can be used is determined according to the determination result, and a response to the information processing terminal 3 is made. Further, the log data 10 uploaded from the IC card 2 is accumulated and stored.

In the log analysis process, for example, whether or not a predetermined use availability determination condition is satisfied, for example, when PIN authentication failure is continuously performed every day, or when the input PIN code is continuously input as a serial number. Is determined. It is desirable that the usability determination condition can be changed according to the use environment of the IC card 2 and the required security strength.
In addition, since past logs are recorded in the log server 5 for the IC card 2, an unauthorized operation may be estimated based on not only acquired log data but also past logs.

  If there is a response from the log server 5 that the use of the IC card 2 is permitted (steps S8 and S9 in FIG. 5, steps S32 and S33 in FIG. 6; Yes), the information processing terminal 3 The lock is released and a command operation to the IC card 2 is accepted (step S34 in FIG. 6).

  On the other hand, if there is a response from the log server 5 that denies use of the IC card 2 (step S8 in FIG. 5, step S32 in FIG. 6, step S33; No), there is a suspicion that an unauthorized operation has been performed. This is notified to the user and the manager (step S35), and the IC card 2 is made unusable (step S36). Notification that there is a suspicion that an illegal operation has been performed is performed by a method such as display on the information processing terminal 3 or transmission of an e-mail addressed to an administrator (log server 5) or a legitimate user. At this time, the log data 10 relating to the IC card 2 may be viewed by a user or an administrator.

When the use of the IC card function is permitted (step S9 in FIG. 5), various processes are executed while communicating between the IC card 2 and the information processing terminal 3 (PC_A).
For example, when the command A is sent from the information processing terminal 3 (PC_A) to the IC card 2, the process A corresponding to the command A is performed in the IC card 2 (step S10), and the log 23b to which the command A is input is displayed. It is recorded in the EEPROM 23 of the IC card 2 (step S11). Thereafter, the processing result is transmitted as a response A to the information processing terminal 3 (PC_A) side.

  Similarly, when another command B is sent from the information processing terminal 3 (PC_A) to the IC card 2, the process B corresponding to the command B is performed in the IC card 2 (step S12), and the command B is input. The log 23b is recorded in the EEPROM 23 of the IC card 2 (step S13). Thereafter, the processing result is transmitted as response B to the information processing terminal 3 (PC_A) side.

  Log data recorded after successful PIN authentication (log 23b recorded in step S11 or step S13) is uploaded to the log server 5 at the next successful PIN authentication.

  After the log data 10 is uploaded to the log server 5, it is not always necessary to leave the log 23b in the IC card 2. Since the memory capacity in the IC card 2 is limited, the uploaded log 23b may be deleted from the EEPROM 23 of the IC card 2 at the stage of obtaining the availability response. However, the log server 5 desirably retains past log data for use in log analysis.

  As described above, in the security management system 1 of the present embodiment, the operation history (log 23b) at the time of PIN authentication of the IC card 2 is held in the IC card 2, and when the authentication is successful, The log 23b is forcibly uploaded to the log server 5 and the log analysis is performed to determine whether the IC card 2 can be used. Therefore, an unauthorized user can detect a history (log) of using the IC card 2.

  Also, operations performed on the IC card 2 after successful authentication are also stored in the IC card 2 as the log 23b, and are uploaded to the log server 5 when the next successful authentication is made to be the target of log analysis. Therefore, since it is possible to detect a history of an unauthorized user executing an unauthorized command on the IC card 2 and a history of an unauthorized operation by a user who succeeded in PIN guessing trial, it is possible to know a valid user or PIN code. Unauthorized use of the IC card 2 by an attacker who has arrived can be detected.

In this embodiment, the security management system 1 using the IC card 2 has been described. However, the present invention can also be applied to a security management system using an offline device other than the IC card 2.
In addition, it is obvious that those skilled in the art can come up with various changes and modifications within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. It is understood.

DESCRIPTION OF SYMBOLS 1 ... Security management system 2 ... IC card 23a ... Authentication information 23b ... Log 3 ... Information processing terminal 4 ... IC card reader / writer 5 ... Log server 9 ... Network 10 ... Log data to be uploaded

Claims (6)

In a security management system that performs authentication processing using the authentication information between a security token in which authentication information is stored and an information processing terminal capable of communication connection with the security token,
The security token is
Authentication process execution means for executing an authentication process based on the authentication information;
An error response means for returning an error response to the information processing terminal when authentication fails in the authentication process;
When an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authentication fails with the security token. A log recording means for generating a log of authentication failure in the case, and recording the log in a predetermined storage area in the security token before returning the error response,
The information processing terminal
Log upload requesting means for requesting the security token to upload the log when the authentication process is successful;
Log analysis means for determining whether the security token has been used illegally based on a log uploaded from the security token in response to a request;
Analysis result processing means for notifying the result of log analysis or requesting to restrict the use of the security token when the log analysis means determines that the security token may have been used illegally When,
Write request means for generating an operation log when an operation is performed on the security token, and transmitting the generated log to the security token together with a log write request command for recording the generated log in the security token;
A security management system comprising: In a security management system that performs authentication processing using the authentication information between a security token in which authentication information is stored and an information processing terminal capable of communication connection with the security token,
The security token is
Authentication process execution means for executing an authentication process based on the authentication information;
An error response means for returning an error response to the information processing terminal when authentication fails in the authentication process;
When an operation is performed on the security token, an operation log is generated on the security token side, forcibly recorded in a predetermined storage area in the security token, and authentication fails with the security token. A log recording means for generating a log of authentication failure in the case, and recording the log in a predetermined storage area in the security token before returning the error response,
The information processing terminal
Log upload requesting means for requesting the security token to upload the log when the authentication process is successful;
Log analysis means for determining whether the security token has been used illegally based on a log uploaded from the security token in response to a request;
Analysis result processing means for notifying the result of log analysis or requesting to restrict the use of the security token when the log analysis means determines that the security token may have been used illegally And comprising
The security token is
Holding a communication monitoring program for monitoring the communication status and command operation with the information processing terminal;
When the security token enters a communication state, the communication monitoring program is started, the command operation performed on the security token is always monitored, and the input command is written in the predetermined storage area as log data.
Security management system according to claim. Wherein the log recorded in the log recording unit, the security management system according to claim 1 or claim 2, characterized in that includes a log of authentication attempts operations. Said log The log is recorded in the recording means, the security management system according to claim 1 or claim 2, characterized in that includes a log of an operation performed with respect to the security token after successful authentication. In a security management method for performing authentication processing using the authentication information between a security token storing authentication information and an information processing terminal capable of communication connection with the security token,
The security token performing an authentication process based on the authentication information;
A step of returning an error response to the information processing terminal when the security token fails in the authentication process;
When the security token performs an operation on the security token, an operation log is generated on the security token side, and the log is forcibly recorded in a predetermined storage area in the security token. Generating an authentication failure log in the case of failure in authentication, and recording it in a predetermined storage area in the security token before returning the error response;
Requesting the information processing terminal to upload the log to the security token when the authentication process is successful;
Based on a log uploaded from the security token in response to a request, the information processing terminal or an external server determining whether the security token has been used illegally;
When it is determined that the security token may have been used illegally, the information processing terminal or the server notifies the result of log analysis or requests to restrict the use of the security token. Steps,
A step of generating an operation log when the information processing terminal performs an operation on the security token, and transmitting the generated log to the security token together with a log write request command for recording the generated log in the security token; When,
The security management method characterized by performing the process including this. In a security management method for performing authentication processing using the authentication information between a security token storing authentication information and an information processing terminal capable of communication connection with the security token,
The security token performing an authentication process based on the authentication information;
A step of returning an error response to the information processing terminal when the security token fails in the authentication process;
When the security token performs an operation on the security token, an operation log is generated on the security token side, and the log is forcibly recorded in a predetermined storage area in the security token. Generating an authentication failure log in the case of failure in authentication, and recording it in a predetermined storage area in the security token before returning the error response;
Requesting the information processing terminal to upload the log to the security token when the authentication process is successful;
Based on a log uploaded from the security token in response to a request, the information processing terminal or an external server determining whether the security token has been used illegally;
When it is determined that the security token may have been used illegally, the information processing terminal or the server notifies the result of log analysis or requests to restrict the use of the security token. Steps,
It performs the processing including,
The security token is
Holding a communication monitoring program for monitoring the communication status and command operation with the information processing terminal;
When the security token enters a communication state, the communication monitoring program is started, command operations performed on the security token are always monitored, and the input command is written as log data in the predetermined storage area. > A security management method characterized by:

Images