JPH01154271A - Management system for dynamic password - Google Patents

Abstract

PURPOSE:To improve the security of passwords by dividing an n-digit alphameric character into (m) pieces to perform the comparison of passwords for each divided character group and replacing these groups when on coincidence is obtained between passwords. CONSTITUTION:A password input means 1 divides an n-digit alphameric character into (m) pieces and compares the password supplied from a terminal with the password supplied from a password library 4 for each divided character group. In case coincidence is obtained between prescribed specific groups with noncoincidence secured between other groups, a password check means 2 replaces the divided groups. In this case, a proper user replaces the passwords for execution of access based on a pattern decided previously after the misinput of passwords. While a hacker changes successively the n-digit alphameric character to try access but is unable to reach a password.

Description

[Detailed Description of the Invention] [Summary] Regarding a password management method for checking access to an information processing system, the purpose of preventing unauthorized access is to provide a password input means for inputting a password from a password library and a password input means for inputting a password from a terminal. a password checking means for dividing the password and comparing and checking each divided character group with the password input by the password input means; and a password changing means for replacing the divided character groups of the password according to the test result of the password checking means,
As a result of the comparison test by the password checking means, when the predetermined divided character groups match and the other divided character groups do not match, the password replacing means replaces the divided character groups, and the password checking means thereafter performs the replacement. Configure to perform a comparison check using a password.

[Industrial application field]

The present invention relates to a password management method for checking unauthorized access to an information processing system.

User identification codes and passwords are used to check access to information processing systems such as TSS (time sharing systems), database systems, and VANs (value added networks). However, current password management methods are insufficient to protect against backers attempting unauthorized access, and countermeasures are desired.

[Conventional technology]

Checking the legitimacy of access to the information processing system is
Generally, the user identification code is a password. That is, a user accesses by using a user identification code, and if the user identification code is valid, the system requests each user to send a registered password and checks the validity of the sent password.

Conventional passwords are generally represented by one-digit alphanumeric characters and are fixedly determined for each user.

[Problem that the invention seeks to solve]

Conventional passwords are insufficient to check against those with legitimate access rights (generally called hackers) who attempt unauthorized access.

Backers can always figure out the password by accessing the site by sequentially changing the single-digit alphanumeric characters using a computer.

For example, assuming a 4-digit alphanumeric password, (36
)'' times (all combinations of 26 alphabetic characters, 10 numbers, and a total of 36 four digits), there is a problem that an intrusion is possible.

Furthermore, in order to strictly check usage rights, there is a method of providing multiple passwords, but this method has the problem of being extremely troublesome for the user.

The present invention aims to provide a dynamic password management system that solves these conventional problems.

[Means for solving problems]

FIG. 1 shows a principle block diagram of the dynamic password management method of the present invention.

In the figure, l is a password input means, and a password is input from a password library.

Reference numeral 2 denotes a password checking means, which divides the password input from the terminal and compares and checks each divided character group with the password input by the password input means 1.

Reference numeral 3 denotes a password replacement means, which replaces the character group of the password based on the inspection result of the password inspection means 2.

4 is a password library, which stores registered passwords.

[For production]

In the present invention, the password is composed of one digit alphanumeric character, and one
Divide alphanumeric digits into m (m<n) L, divided character groups (
For each group (hereinafter referred to as a group), the password input from the terminal is compared and inspected with the password input from the password library.

As a result of the comparison test, a specific predetermined group matches,
If the other loops do not match, the divided groups for the user's password are replaced.

In other words, the system recognizes that it is an erroneous input by a legitimate user or an access by a backer, and takes appropriate action.

After a legitimate user enters a password incorrectly, they should change it according to the pattern taught in advance.
to access.

By performing this replacement, the backer will not be able to reach the password even if he or she attempts to access the password (36)'' times by sequentially changing the single-digit alphanumeric characters.

FIG. 2 is a diagram showing an example in which the present invention is applied to a four-digit password.

Figure 2 (al indicates the password division pattern, 4
The digit number is divided into the upper two digits (A group) and the lower two digits (B group). The upper two digits (A group) are the key group.

Now, if the user's password is "1294", the password the user should recognize is "1294" or "
9412''.

FIG. 2 (bl is a diagram showing the relationship between passwords managed by the system and numbers accessed by backers.

When a hacker uses a computer to try to access in ascending order starting from 0000, the system matches group A when it reaches 1200, but does not match group B, so the groups are swapped. Thereafter, when the backer repeats access in ascending order and reaches 9400, the groups are swapped again.

Since it is not known at what point the change occurred, no countermeasure can be taken against the hacker, indicating that the password cannot be reached even after (36)" access attempts.

〔Example〕

The present invention will be explained in more detail below with reference to embodiments shown in FIGS. 3 to 5.

FIG. 3 shows the system configuration of one embodiment of the present invention, which is a storage device that controls the entire system.

While the system is open, the central processing unit 10 takes out the password check program from the magnetic disk device and stores it in the main storage device 20, and executes password check processing using the program every time a connection request is received from a terminal device.

30 is a communication processing device, which controls communication with each terminal device and other center machines.

Magnetic disk devices 41 and 42 store each file and program of the system. Password library (PWL) is also stored here.

50 is a display device (including a keyboard);
A printer 60 is used for system management.

? 1, 72, and 73 are terminal devices that access and share the system.

Reference numeral 100 indicates another center machine, which is mutually accessible with this system.

FIG. 4 is a flowchart showing processing according to an embodiment of the present invention.

In this example, the password is divided into two groups. The operation will be explained below according to the steps of the flowchart.

- Search the password library in the magnetic disk device (D ASD) using the user ID (identification code) input by the user by LOGON (start of access) and import the password.

■Compare the password input by the user with the words of group A (key group) of the password imported from the password library. - When it matches, proceed to step ■, and when it does not match, jump to step ■.

■Similarly, compare the words in group B. If they match, proceed to step ■; if they do not match, proceed to step ■.

■Session (period of logical connection between @ end and center system) opened 0. Finally, the system usage is 0. To,
issue a notification.

■About the password for this = Pig user, A Guruleaf.

and exchange the values of group B.

■Reflect the changed value in the password library. Specifically, each password has a reversal flag, and when changing groups, the flag is turned on, and when changing back, it is turned off. , When inputting the password in step (2), read the flag and put it in the register as is or inverted.

■Open the session N, G, notify the user that the password is incorrect, and return to step ■.

FIG. 5 is a diagram showing restrictions on password assignment when implementing the present invention.

(No. 11, ``When dividing, the alphanumeric characters in the divided groups do not match'' naturally means that the effect of replacement is lost.

(2), ``When dividing, the group value must be a value other than all 0'' is avoided because when searching in ascending order, the carry becomes 00, which results in a match.

(3), ``When dividing, the group value must be a value other than all 9'' is to avoid this, since when searching in descending order, the result will be 99 due to the downturn, which will result in a match.

〔Effect of the invention〕

As explained above, according to the present invention, password security can be greatly improved with a relatively simple configuration, and it can be applied to an existing system by simply adding determination processing and replacement processing when password is accessed. It can be done with relatively little complexity for the user, and its practical effects are extremely large.

[Brief explanation of the drawing]

FIG. 1 is a block diagram of the principle of the present invention. FIG. 2 is a diagram showing an example of password verification processing according to the present invention. FIG. 3 is a diagram showing a system configuration of an embodiment of the present invention. FIG. 4 is a diagram showing the system configuration of an embodiment of the present invention. FIG. 5 is a flowchart showing processing according to an embodiment. FIG. 5 is a diagram showing restrictions on password assignment. In the drawing, l is a password input means, 2 is a password check means, 3 is a password replacement means, 4 is a password library, 10 is a central processing unit, 20 is a main storage device, 30 is a communication processing device, 41.42 is a magnetic disk device, 50 is a display device, 60 is a printer, 71, 72.73
100 indicates a terminal device, and 100 indicates another center machine. Figure 1 (a) is a block diagram of the principle of the present invention; Figure 3 is a diagram showing the system configuration of the entire system of the present invention.
Fig. 1 is a flowchart showing processing according to an embodiment of the present invention.
4 Figure

Claims (1)

[Claims] In a password verification process for checking the right to use an information processing system, a password input means (1) for inputting a password from a password library; and a password input means (1) for inputting a password from a terminal; Password checking means (2) that compares each character group with the password input by the password input means (1); and Password changing means (3) that replaces the divided character groups of the password based on the test results of the password checking means (2). ), and as a result of the comparison test by the password checking means (2), when the predetermined divided character groups match and the other divided character groups do not match, the password replacing means (3) replaces the divided character groups. , a dynamic password management system characterized in that the password checking means (2) is configured to perform a comparative check using passwords that have been replaced thereafter.