JPH01224858A - Illegal access preventing method for computer and board device used for it - Google Patents

Abstract

PURPOSE:To prevent a hacker from illegally accessing a computer by simultaneously deciding the errors of a series of codes when >=2 series of codes are inputted or the all inputs are completed. CONSTITUTION:A host computer decides the errors whenever each one of a series of codes is inputted, and only when it is correct and when the all input of a series of the codes are executed in a different way from the method to require the next code input, since the simultaneous errors decision is executed, the number of combinations can be made extremely large. For example, when the first code consists of English letters having four digits and the second code to be next inputted consists of numbers having the four digits, (=26<4>X10<4>) combinations to be the product of the combinations of the first and second codes can be obtained, and the retrieve of the code of an unauthorized user by the hacker is made extremely difficult.

Description

[Detailed Description of the Invention] [Field of Industrial Application] The present invention relates to a method for preventing unauthorized access to a computer and a board device used therein, and particularly to a method for preventing unauthorized access to a computer by an infringer (backer) who is not an authorized user of the computer. The present invention relates to a method for preventing this and a board device used therefor.

[Conventional technology]

Computer systems are usually designed so that only a limited number of specific users (authorized users) can access their fR-heavy system resources, but unauthorized access by unauthorized users called backers is a problem. It has become.

The characteristic of computer crimes carried out by backers is that, unlike theft, they can infiltrate the computer from a remote location using a network such as a telephone line, without having to invade the building where the computer is located. To the point where it doesn't. Therefore, it is always difficult to identify the crime, and since unauthorized access is possible through terminals such as microcomputers, there is a high possibility that the crime was committed by an unspecified person.

Conventionally, in order to prevent unauthorized computer access by backers, authorized users register their user names and passwords in the Combita system in advance.
At the time of access, the user name and password were entered and compared with those registered.

For example, in the conventional computer unauthorized access prevention method, as shown in the flowchart of Fig. 6, the user inputs his/her name and ID number (Step SI), and the post computer registers in advance whether or not the input is correct. The host computer determines the password by referring to the name and ID number (Step S2), and if the password is correct, requests the user to input the password. When the password is input (Step S3), the host computer selects one of the passwords registered in advance. If it is correct, the host computer requests the project master and inputs the project name (step Ss), and then similarly judges whether it is correct or incorrect (step Sg). ). If this person's name - is correct, the host computer notifies the user of permission to access (step S7).
.

On the other hand, each step S2. If there is any error in the determination of whether the input is correct or incorrect in S4 and S6, the host computer notifies the user that access is not permitted (step Ss).

[Problem to be solved by the invention]

However, as shown in Figure 6, in the conventional method described above, each time a user enters a password, it is determined whether it is correct or not, and when it is determined that the input is incorrect, access is immediately disabled. Because it was a method of notifying permission,
Name (user name).

The only number of combinations available is the sum of the number of combinations of ID number, password, and project name, and the number that can be selected is small. For example, if there are two 2-digit codes, the number of 2-digit code combinations from r OOj to r 99.1 is "
100'', so in the above case only 200'' combinations can be obtained.

In addition, each user must memorize the above-mentioned series of codes consisting of user name, password, and one business name, so each code must be within 10 digits at most, usually 4
-6 digits. Therefore, it was not sufficient to prevent backers from using other computers and sequentially searching for the above series of codes using computer networks and gaining unauthorized access to the host computer.

The present invention has been made in view of the above points, and an object of the present invention is to provide a method for preventing unauthorized computer access that can sufficiently prevent unauthorized computer access by backers, and a board device used therein.

[Means to solve the problem]

In order to achieve the above object, the method for preventing unauthorized access to a computer of the present invention provides a method for preventing unauthorized access to a computer when a series of codes including a password input by a user of a terminal is inputted, or when all the codes are inputted. A computer simultaneously determines whether a series of codes are correct or incorrect.

Further, a fingerprint code registered in advance is provided in the series of codes.

In addition, the host computer has a calling means that completely disconnects the line from the terminal by inputting a telephone number from the terminal, then reconnects the line and calls the terminal using the input telephone number. Before or after calling by the means, the host computer determines whether the series of codes is correct or incorrect.

The host computer consists of a first host computer that can both read and write data banks, and a second host computer that can only read data banks, and the terminal is connected to the second host computer via a line. only connected.

Further, the board device used in the method for preventing unauthorized access to a combination device of the present invention is configured to be detachable from the terminal, and the fingerprint image data connected to the terminal can be transferred to the terminal by being attached to the terminal. Convert to digital data that can be read by the host computer.

[Effect]

Unlike the conventional method in which the host computer determines whether each code in the series of codes above is correct or incorrect each time it is input, and requests the next code to be input only if the code is correct, the host computer determines whether the code in the series of codes is correct or not. Since the judgment of correctness or incorrectness is made simultaneously at a certain point in time, the number of combinations can be extremely large.

For example, if the first code is a 4-digit alphanumeric character and the second code that is input next is a 4-digit number, then in the conventional method the number of combinations by the first code is 456,976 (
= 26'), and the number of second code combinations is 1000.
0 (= 10'), so their sum is 466
Whereas only 976 combinations were obtained, according to the present invention, the product of each combination of the first code and the second code is 4,569.760.000 (=264 x
10') combinations are possible, and the number of combinations can be increased by 4.569,293,024 compared to the conventional method. Therefore, according to the present invention, compared to the prior art,
It can make it significantly harder for backers to find legitimate users' code.

Further, the fingerprint code is data of the user's own fingerprint recorded in the host computer in advance. As is well known, no two people have the same fingerprints, and fingerprints do not change unless they are damaged, which are two major characteristics that make it possible to identify individuals based on their fingerprints. Since a valid user has registered this fingerprint code in advance, only a valid user can be identified by identifying the input fingerprint code with the registered one.

Furthermore, in the present invention, the host computer completely separates the telephone line by inputting a telephone number from the terminal, and then calls the telephone line from the host computer using the same telephone number, and inputs a series of codes before or after that. Since it determines whether the phone number is correct or incorrect, it is possible to check all phone calls used by illegal backers.

Furthermore, in the present invention, since the line from the terminal is connected only to the read-only host computer of the data bank, access from the terminal to the host computer that would alter the contents of the data bank is impossible.

Furthermore, the board device of the present invention for obtaining the fingerprint code is a plug-in card for a terminal, and there is no need to process the fingerprint image in the terminal, and the processing of the fingerprint image can be performed in the host computer. .

〔Example〕

FIG. 1 is a block diagram of a combinator system having an embodiment of the device δ of the present invention, and FIG. 2 is a flowchart of an embodiment of the method of the present invention. In FIG. 1, numeral 1 denotes a microcomputer, which together with a modem 2 constitutes a terminal.

3 is a board of an embodiment of the board device according to the present invention (
The microcomputer 1 is a plug-in card) that can be attached to and detached from the microcomputer 1, and when attached to the microcomputer 1, it is also connected to the fingerprint sensor 4.

The fingerprint sensor 4 is a charge-coupled device (COD).
Coupled Device), CPD (C
harge Pr1m1nq Device),
Or M OS (M etal Oxide
An optical sensor such as a sensor (Selector) type, or a optical position detector (PSD)
When a user places a finger on the sensor part, the fingerprint is sent to the board 3 as image data from the sensitive points of each mesh of 512 x 512 meshes or more. Since a fingerprint is a line pattern formed on the skin, the end point where a ridge breaks or the bifurcation point where a ridge splits into two is called a minutiae and is traditionally used as a feature point. , the fingerprint sensor 4 sends fingerprint image data indicating not only the minutiae points but also the number of ridges between the minutiae points to the board 3 in parallel or partially in series.

The board 3 is attached to the microcomputer 1, and
By using the accompanying dedicated software, the above-mentioned fingerprint image data is converted into a serial code that can be decoded by the host computer (mainframe) 7. This serial code goes from modem 2 to telephone line 5. It is sent to the host computer 7 via the modem 6. Note that the recording device 8 records part or all of the data input via the modem 6 for crime prevention.

Next, an embodiment of the method of the present invention in such a combinator system will be described with reference to FIGS. 1 and 2. First, the user inputs his or her name and ID number into the host computer 7 using the microcomputer 1 (step Su in FIG. 2). Then, the postcomputer 7 confirms the input of the catch and ID number (however, it does not judge whether it is correct or incorrect), and then returns a password and fingerprint code input request to the ficrocomputer 1 side.

This allows the user to enter their password and then
The fingerprint code is input to the host computer 7 as described above using the board 3 and the fingerprint sensor 4 (in Fig. 2,
Step 512). In response to these inputs, the host computer 7 then returns a project name input request to the microcomputer 1 side.

In accordance with this input request, the user then inputs the project name using the microcomputer 1 and sends it to the host computer 7 (step So in FIG. 2).

The host computer 7 extracts a series of codes consisting of the user's name, ID number, password, fingerprint, and project name inputted in sequence in this way from among the corresponding codes recorded in advance and sequentially reads them. Comparison and collation are carried out, and the correct/incorrect judgment is made at the same time (step S14.8 in Fig. 2).
's, S+s). If the input codes all match the registered ones, the host computer 7 notifies the microcomputer 1 of access permission (step Sy in Figure 2), and if there is an error in any one of them, access is denied. The permission is notified to the microcomputer 1 side (step S's in the same example).

In this embodiment, each human-powered code is not determined to be correct or incorrect each time, but all codes are judged to be correct or incorrect as one code when all the codes are completed, so that the combination of the codes is as described above. Since the number of users is extremely large, it is possible to determine with extremely high accuracy whether or not a user is officially registered. Moreover, since the above-mentioned series of codes includes a fingerprint code, it is possible to make illegal access to the host computer 7 by backers almost impossible. Furthermore, fingerprints are the user's own physical characteristics, and 10
Since there is no necessity to memorize things like ¥1, passwords, project names, etc., the user's memory information can be the same as before.

Next, another embodiment of the method of the present invention will be described with reference to chart 70 in FIG. After calling the host computer 7 using the modem 2 shown in FIG. 1, the user inputs the user contact telephone number (the telephone number assigned to the modem 2) at the request of the host computer 7. (
Step 521 in FIG. 3). As a result, the host computer 1-tough memorizes this input telephone number and then completely disconnects the telephone line 5 from the modem 2 (
Step 522 in FIG. 3).

Next, the host computer 7 calls the user using the stored telephone number (step 523 in FIG. 3). The user then enters a series of codes, including a password (step 524 in Figure 3). This series of codes may include the above-described fingerprint code, or may have the same configuration as the conventional one in which the fingerprint code is not included.

By inputting this series of codes, the host computer 7 compares and collates the codes registered in advance and determines whether or not they match (step 52S in FIG. 3).
Note that this input determination may be performed simultaneously as shown in FIG. 2, or may be performed using the same conventional method.

If there is a match in this judgment, the host computer 7 sends an access permission to the microphone [1 to notify the computer 1 side (step Sg in FIG. 3), and if they do not match, the host computer 7 sends an access permission to the input computer or recording device 8 shown in FIG. 1. Record all inputs such as the telephone number (step 521).
.

As described above, according to this embodiment, even if a backer tries to illegally access the host computer 7, the phone number used can be recorded, which is effective for future crime prevention measures, and also prevents the backer from gaining unauthorized access to the host computer 7. If you enter the phone number of a legitimate user, the line connection to the backer's modem will not be established, making it possible to prevent unauthorized access in advance and in an extremely sophisticated way.

Note that this embodiment is similar at first glance to the conventionally known answerback method, but the answerback method temporarily separates the user from the system before allowing access to system resources; It is not completely separate, but is connected to the user by a gate, and in that state, the user can call a predetermined phone number separately and call that person (someone other than the user). With permission,
In contrast to this method, which allows the user to access for the first time, in this embodiment, the telephone line is completely disconnected, and then the entered telephone number is called again from the host computer, which is different from the answer-back method. Totally different.

In addition, in Figure 3, the user enters a series of codes including a password by invading the user's call.
Part or all of this may be done before the telephone line is separated.

Next, another embodiment of the method of the present invention will be described with reference to FIG. In the same bacterium, the same components as those in FIG. In FIG. 4, 11 and 12 are host computers, respectively, and 13 is a data bank. , the host computer 11 is the data bank 13
The host computer 12 is a computer that can read and write the data bank 13 at will. .

The host computer 12 has a configuration in which the writing head is removed from the computer to make writing mechanically impossible;
■Software (configuration that ignores write commands at O8>,
■It is either a configuration that incorporates software or hardware that selects and passes input from the network using only specified human power.

A terminal consisting of a microcomputer 1 etc. is connected to a read-only host computer 12 via a telephone line 5 and a modem 6.
Since the line is connected only to the data bank 13, the terminal usage name can only be read from the data bank 13 and cannot be read.

Modern computers store a lot of data in external storage devices, use it as a data bank, read it,
Writing and rewriting are performed by -1 computers all at once. However, data banks often permit use by an unspecified number of people, and a zero-record system is often impossible. Therefore, it has become a problem that the contents of the data bank may be altered due to unauthorized computer access.

However, according to this embodiment, since the host computer 12, which can be used by a large number of general public, is unable to write to the data bank 13, alteration of the contents of the data bank 13 by unauthorized users is completely prevented. be able to. Furthermore, the contents of the data bank 13 can be modified only via an independent host computer 11 that is not networked. Note that the host computers 11 and 12 are not limited to the case where two units are used for each hardware, but it is also possible to modify the software (vfGL: O8) of one computer, and this embodiment does not include such a case. be.

Although FIG. 4 shows a board 3 and a fingerprint sensor 4, the terminal side may have the same configuration as the conventional one.

Furthermore, the fingerprint sensor 4 may have a configuration as shown in FIG. 5 in addition to the configuration described above. In the figure, reference numeral 15 denotes a contact film, which is made of a super-grooved film with high thermal conductivity, and converts a fingerprint, which is a line pattern on the skin of the finger 16, into a heat distribution pattern. 17 is an optical system, 18 is an infrared sensor, and 19 is a processing device.

The thermal pattern obtained by the contact film 15 described above is detected by an infrared sensor 18 through an optical system 17. The image of the thermal pattern of the fingerprint obtained by the infrared sensor 18 is supplied to the signal processing bag 19, where it is converted into a digital signal and output.4 Note that the present invention is limited to each of the above embodiments. Instead, for example, in Fig. 2, steps S14 and S's are brought between steps S+z and 813, and the name, (0 number, password, and fingerprint are checked all at once, and the project name is left alone as before. You may also check it with .

[Efficacy of invention Song Dynasty]

As described above, according to the present invention, it is determined whether the user of the computer is a registered person based on the match/mismatch of fingerprints, and the time when two or more input codes are input, or when all input codes are input. Since the correctness is determined after the code has been entered, it is virtually impossible for backers to access the computer illegally, and since the amount of information in the input code is huge, it is difficult for backers to search for the code using a microcomputer. Moreover, since the fingerprint does not need to be memorized by the user, it is necessary for the user to memorize it in order to access the computer (the amount of information may remain the same as before).

In addition, if the backer enters his or her own phone number when the host calls the backer's phone number, the backer will be able to identify the backer, which was previously extremely difficult due to the person being in a remote location. phone? The record in No. 1 can be used to identify the user and prevent subsequent unauthorized access. On the other hand, if the backer enters the phone number of another authorized user, it is possible to prevent the backer from illegally accessing the computer.

In addition, if the terminal connects the T-tabank via a read-only computer, it is impossible to modify the contents of the databank by an unspecified number of people. Since the terminal is configured to be detachable, it has many features such as being able to be used as needed without sacrificing the versatility of the terminal.

[Brief explanation of the drawing]

1 is a block diagram of a computer system having an embodiment of the apparatus of the present invention; FIG. 2 is a flowchart of an embodiment of the method of the present invention; FIG. 3 is a flowchart of another embodiment of the method of the present invention; FIG. 5 is a block diagram showing still another embodiment of the method of the present invention, FIG. 5 is a block diagram of an embodiment of the fingerprint sensor, and FIG. 6 is a 70-chart of an example of the conventional method. 1...Microcomputer, 2.6...Modem,
3... Board, 4... Fingerprint sensor, 5... Telephone line, 7... Host computer, 11... Read/
Write-only host computer, 12... Read-only host computer, 13... Data bank. Patent applicant: M.1.M.G.I. Limited
Ben Sokushi Matsuura Kaneyuki ゛・ノ゛゛・ノ゛゛・の゛゛・の目゛゛・の゛゛゛・の目゛゛・の目゛゛・の目゛゛・の目゛.
Figure 2 No. 411 Ladle Soft Seshi Size Sea Dai 1 Ij's Ope 2 Yashini's Left -e) I's Flow To--to I A r
i'1

Claims (7)

[Claims] (1) When a terminal user enters a series of codes including a password and compares them with a series of pre-registered codes on a host computer connected to the terminal via a line, and the results do not match. In a method for preventing unauthorized access to a computer that disallows the user from accessing the host computer, the series of codes is determined to be correct or incorrect when two or more of the series of codes have been input or when all the codes have been input. A method for preventing unauthorized access to a computer, characterized by performing the following at the same time. (2) When a terminal user enters a series of codes including a password and compares them with a series of pre-registered codes on a host computer connected to the terminal via a line, and the results do not match. In a method for preventing unauthorized access to a computer which disallows the user from accessing the host computer, a pre-registered fingerprint code is provided in a series of codes input by the user, and a series of codes including the fingerprint code are provided in the series of codes input by the user. A method for preventing unauthorized access to a computer, characterized in that the host computer simultaneously determines whether a series of codes including the fingerprint code are correct or incorrect when two or more codes are input or when all codes have been input. (3) A user of a terminal calls a host computer connected to the terminal via a telephone line, and then the user enters a series of codes including a password, which are registered in advance on the host computer. In a computer unauthorized access prevention method that disallows the user to access the host computer if the result of comparing and checking a series of codes does not match, the host computer accesses the terminal by inputting the phone number of the terminal. It has a calling means that once completely disconnects the line connection from the terminal and then reconnects the line and calls the terminal using the entered telephone number, and the host computer calls the terminal before or after the calling means calls. A method for preventing unauthorized computer access, characterized by determining whether a series of codes are correct or incorrect. (4) A fingerprint code of the user registered in advance in the host computer is provided in the series of codes input by the user, and the host computer inputs two or more series of codes including the fingerprint code. 4. The method for preventing unauthorized access to a computer according to claim 3, wherein a series of codes including the fingerprint code are judged to be correct or incorrect at the same time when the fingerprint code is entered or when all the codes have been input. (5) When a terminal user enters a series of codes including a password and compares them with a series of pre-registered codes on a host computer connected to the terminal via a line, and there is no discrepancy. In the method for preventing unauthorized access to a computer, the host computer disallows access to the host computer by the user, the host computer includes a first host computer capable of both reading and writing data banks; 1. A method for preventing unauthorized access to a computer, comprising a dedicated second host computer, and the terminal is connected only to the second host computer via a line. (6) A fingerprint code of the user registered in advance in the second host computer is provided in the series of codes input by the user, and the second host computer 6. The method for preventing unauthorized access to a computer according to claim 5, wherein a series of codes including the fingerprint code are judged to be correct or incorrect at the same time when two or more codes have been input or when all codes have been input. (7) It is configured to be detachable from the terminal, and converts fingerprint image data from a fingerprint sensor connected to the terminal into digital data that can be read by the host computer by being attached to the terminal. 7. A board device used in a method for preventing unauthorized computer access according to claim 2, 4 or 6.