JPH01296366A - Terminal locking device for keeping secrecy - Google Patents

Abstract

PURPOSE:To reduce the burden of the user of a user terminal at the time of locking his terminal and, at the same time, to secure the safety of the system by providing a means which discriminates the reception of the lock controlling characters of the user terminal, means which discriminates the coincidence between the lock control characters with a previously set password characters, etc. CONSTITUTION:Data inputted from the input device 4 of a user terminal are inputted to a terminal lock controlling section 9 though an input buffer 5 and whether or not the data are lock controlling characters is checked. When the data are discriminated as lock controlling characters, 'BREAK' is sent to an output device 2 as a screen clearing code and, at the same time, 'start' is instructed to a timer controlling section 8 and all characters inputted thereafter are sent to a password character discriminating section 10 for discrimination. When inputted data coincide with password characters, a 'timer stop' is instructed to the controlling section 8 and, at the same time, a coincidence signal is sent to the controlling section 9. As a result, the 'BREAK' on the screen of the device 2 is erased and normal control takes place. When they do not coincide with each other, the process is forcible terminated. Thus the burden of the user can be reduced and the safety of the system can be secured at the time of locking his user terminal.

Description

Detailed Description of the Invention Technical Field The present invention relates to a terminal locking device for maintaining confidentiality in a data processing system that connects a plurality of terminals and operates in multi-user and multi-task manner, and in particular, relates to a terminal locking device for maintaining confidentiality in a data processing system that connects a plurality of terminals and operates in a multi-user and multi-tasking manner. The present invention relates to a terminal locking device for maintaining confidentiality to prevent leakage of confidential information.

BACKGROUND ART Conventionally, in a system that connects multiple terminals and operates as a multi-user and multi-task system, when a certain terminal performs secret work on an external device or works with the rights of the administrator of the system, - Occasionally, workers would log out every time they left the terminal, and then log in again when they returned.

This method requires complicated operations, and 1. For example, if you are working with a window system using many windows, just logging out can be a heavy burden.

Conventional confidentiality is discussed, for example, in "Computer Security," by Tadahiro Uezono, Kindai Kagakusha (1981).

Purpose The purpose of the present invention is to improve such problems and reduce the load on the user when locking the terminal.

It is also an object of the present invention to provide a terminal locking device for maintaining confidentiality that can protect the security of the system.

Configuration In order to achieve the above-mentioned object, the terminal locking device for maintaining confidentiality of the present invention is provided with a data processing system that includes a system console, connects a plurality of user terminals, and performs a plurality of operations. A means (terminal lock control unit) for determining whether a character for controlling the lock has been received, a means for determining whether or not a predetermined period of time has elapsed since the user terminal was locked, and a PIN code for a predetermined number of times or more when the user terminal is locked. A means for measuring whether or not an input has failed (a timer control unit); a means for determining whether or not the characters input when the user terminal is locked match a preset password character (a password determination unit); , controls its timer control unit and password determination unit, and if a predetermined period of time or more has elapsed since the user terminal was locked, and if the user fails to input the password a predetermined number of times or more when the user terminal is locked, means (terminal lock control unit) for forcibly terminating the process of the user terminal, outputting a message to the system console, and recording it in a log file, and upon receiving a lock control character from the user terminal, the data processing device The side interrupts input/output to the user terminal, outputs a message indicating that it is in a locked state to the user terminal, and if a password is entered within a predetermined time, releases the locked state and resumes input/output control, In addition, if a password is not entered within a predetermined period of time, or if the password entry fails more than a predetermined number of times, the process on the user terminal is forcibly terminated, a message is output to the system console, and a log file is written. It is characterized by recording.

An embodiment of the present invention will be described below with reference to the drawings.

First, the training, functions, and overall operation of this embodiment will be described.

FIG. 2 is a configuration diagram of a data processing system in one embodiment of the present invention.

The data processing system of this embodiment includes a system console 21, a CPU 22, a main memory (MEM) 23, a disk controller 24, a disk device 25, a terminal processor 26, and a plurality of user terminals 27.
Works with multiple users and multiple tasks.

This CPU 22 manages a plurality of user terminals 27 connected to the terminal processor 26 via the terminal processor 26 . In particular, in this embodiment, a timer control unit 8. Terminal lock control section 9 and password determination section 1
0 (see Figure 1).

The system console 21 also includes each user terminal 27.
The management status of is output.

The disk device 25 also contains display data (terminal lock display, unlock display) that is output to the user terminal 27 when the terminal is locked, abnormal situations (when the locked state continues for a predetermined period of time, and password input). A message to be outputted to the system console 21 (if a failure occurs a predetermined number of times or more) is stored, and is controlled by the disk controller 24.

FIG. 1 is a functional configuration diagram of a terminal locking device according to an embodiment of the present invention.

The terminal lock device in the data processing system of this embodiment includes an output control section 1, an output device 2, an output buffer 3, and an input bag r! i4, input buffer 5, character control unit 6, OS kernel 7, timer control unit 8, terminal lock control unit 9. It includes a password determination section 10, a system console output device 11, and an input control section 12.

The input device 4 and the output bag [2 are input/output devices of the plurality of user terminals 27 shown in FIG. 1.

Further, the system console output device 11 is an output device of the system console 21 shown in FIG. 1, and is a terminal of a system administrator.

Further, the OS kernel 7 is located above the terminal control unit (terminal driver) in the O8.

The timer control unit 8 is located in the terminal control unit (terminal driver) in the O8, and also checks whether a predetermined time has elapsed since the user terminal 27 was locked, and if a password input error has occurred more than a predetermined number of times. decide whether or not.

Further, the password character determination section 10 is located in the terminal control section (terminal driver) in O8, and determines whether or not a password for unlocking the user terminal 27 has been correctly input.

The terminal lock control unit 9 also checks the lock control character of the input data and checks the output device 2 when lock control occurs.
display on the output device 2 when lock control is released,
It controls the password character determination section 10, the timer control section 8, and the like.

With this configuration, data input from the input device 4 of the user terminal 27 is stored in the input buffer 5 under the control of the input control section 12.

The data enters the terminal lock control section 9, and it is determined whether or not it is a lock control character. For example, if the lock control character is assumed to be control N, it is checked whether it is control N or not.

As a result, if the control is N, a screen clearing code is sent to the output device 2 of the user terminal 27, and '
Send the text BREAK'.

From this point on, all characters input are passed to the password character determination section 10 and determined.

As a result, if the input characters match the preset password characters, a match signal is sent to the terminal lock control section 9.

When the terminal lock control section 9 receives a match signal from the password determination section 10, that is, a signal indicating that the passwords match, it sends a screen clear code to the output device 2 again.
Return to normal control.

Note that in normal control, that is, control when a character other than a lock control character is input, the input character enters the terminal lock control unit 9 from the input buffer 5, is passed as is to the character control unit 6, and is the character to be echoed back. It is determined whether or not the message is present, and if necessary, it is echoed back. In addition, separators (carriage return (CR), line field (LF)
etc.) to the OS kernel 7.

Furthermore, data is not passed to the character control section 6 until it is determined that the password characters match. Therefore, characters from the input device 4 are not echoed back, and no data is passed to the OS kernel 7 either.

Furthermore, this embodiment has a terminal lock monitoring function for the system administrator.

That is, after the user terminal 27 is in the locked state,
If the lock is not unlocked even after a certain period of time has elapsed, or if the user terminal 27 in the locked state is attempted several times to enter a password for unlocking, but is unsuccessful. In this case, the O8 outputs a message to the system console 21, which is the system administrator's terminal, records it in a log file, and forcibly terminates the user process. Note that this message is output even when the system console 21 is locked.

The former case is when the user is unable to use the user terminal 27 for a long time for some reason, and there is a risk that a third party may illegally use the system, and the latter case is when the user is unable to use the user terminal 27 for a long time. temporarily leave the user terminal 27,
This is because it is assumed that a third party is attempting to illegally unlock the terminal.

Next, details of processing in the timer control section 8, terminal lock control section 9, and password character determination section 10 will be described.

FIG. 3 is a flowchart showing the processing of the terminal lock control section in one embodiment of the present invention, FIG. 4 is a flowchart showing the processing of the password character determination section in one embodiment of the invention, and FIG. The configuration diagram of the timer control section in one embodiment, and FIGS. 6 and 7 are flowcharts showing the processing of the timer control section in one embodiment of the present invention.

In the terminal lock control section 9 of this embodiment, as shown in FIG.
In the terminal lock control unit 9 of this embodiment, when a character is input from the input device 4 via the input buffer 5 (301),
It is determined whether or not it is a lock control character (302).

As a result, if it is not a lock control character, the input character is passed to the character control unit 6 as character data 303),
Return to step 301.

Furthermore, if it is a lock control character, a code for clearing one screen is sent to the output device 2 of the user terminal 27 (304), and the characters "T3 RE A K" are displayed on the screen (304).
05).

Next, instruct the timer control unit 8 to start (306),
Clear the PIN character determination buffer (not shown) and press (3)
07), the user terminal 27 is placed in a locked state.

Furthermore, when there is an input from the input device 4 in the locked state, the next character is input from the input buffer 5 (308),
Check for return (309).

As a result, if it is returned, the password determination unit 10
The input data is passed to (310).

Next, it is determined whether the input data and the password match (311).

As a result, when a match signal is sent from the password character determination section 10, it instructs the timer control section 8 to stop the timer (312), outputs a screen clear code to the user terminal 27, and displays it on the screen of the output device 2. Displayed” B RE A
K'' is deleted (31'4).

Further, if a matching signal is not sent from the password character determination unit 1o, the input error is further notified to the timer control unit 8,
The timer control unit 8 determines whether the process has been forcibly terminated (313).

Furthermore, if it is confirmed that the process has been forcibly terminated, the process proceeds to step 312.

Further, if the process has not been forcibly terminated, the process returns to step 308.

Further, regarding the processing procedure of the password character determination unit 10 in this embodiment, as shown in FIG. 4, when input data is passed from the terminal lock control unit 9, the user The ID is extracted and the file is searched (402).

If there is a password character matching the user rD in the file (403), then it is checked whether the input characters obtained from the terminal lock control unit 9 match the password characters in the file (403).
04).

As a result, if they match, OK is returned to the terminal lock control unit 9 (405).

If they do not match, an error is returned to the terminal lock control unit 9 (406).

Further, the timer control unit 8 in this embodiment includes a control unit 81 called from the terminal lock control unit 9, as shown in FIG.
These control units 81 and 82 control the timer start flag 51 and time counter 52 in the management data for each user (user A management data, user B management data). Control.

In addition, the surface control units 81 and 82 do not directly exchange control or data, and the time start flag 51
These exchanges are performed through the time counter 52 and the time counter 52.

The processing procedure of this timer control section 8 is shown in FIGS. 6 and 7.

That is, when called by the terminal lock control unit 9,
As shown in FIG. 6, it is checked whether the command from the terminal lock control unit 9 is a timer start command (601), and if it is a timer start command, the timer start flag 51 of the corresponding user terminal 27 is turned ON (602). ).

If the command is not a timer start command, it is checked whether the command is a timer stop command (603).

As a result, if it is a timer stop command, the timer start flag 51 is turned OFF and L (604), and the time counter 52 is cleared (605).

If it is not a timer stop command, it is checked whether there is a password input error (606).

If the result is a password input error, a password input error counter (not shown) assigned to each user is incremented by one (607).

Next, it is determined whether the password manual error counter exceeds the limit number of times (608).

As a result, if the limit number of times has been exceeded, the user process is forcibly terminated (609), a message indicating that a password input error has occurred more than the limit number of times is output to the system console output device 11, and the system log file is (610).

In addition to such processing, the processor (CPU 22
), the time counter 52 assigned to each user is incremented as necessary by periodic clock interrupts.

In this case, as shown in FIG. 7, if there is a clock interrupt, it is checked whether the timer start flag 51 is ON or not (7
0L).

As a result, if the timer start flag 51 is ON,
Among the time counters 52 assigned to each user, the time counter 52 of the corresponding user is incremented by 1.
- Do (702).

Next, it is determined whether the time counter 52 exceeds a value determined by the system (703).

As a result, if the value exceeds the value determined by the system, a message that the terminal lock was not released within a predetermined time is output to the system console output device 11, and the corresponding user process is forcibly terminated ( 704).

In this way, the timer control unit 8 determines whether a certain period of time has passed since the user terminal 27 was locked. This uses a clock interrupt, which is a normal processor function, to check the passage of one hour by incrementing the system's internal counter using a clock interrupt routine.

Next, the user terminal 27 when the terminal is locked in this embodiment
and output to the system console 21 will be described.

FIG. 8 is an example of a screen display when the terminal is normally locked in an embodiment of the present invention, and FIG. 9 is a screen display when the terminal is not unlocked within a predetermined time in an embodiment of the present invention. Display Example Figure 10 is a screen display example diagram when the terminal is about to be illegally unlocked by a third party in one embodiment of the present invention.

In this embodiment, if the user terminal 27 is locked during work and the terminal is unlocked within a predetermined time, the user terminal 27
The screen display of No. 7 output bag gi2 is shown in FIG.

In this case, the state of work 1r! In A(a), when the user leaves the user terminal 27, he inputs lock control characters from the input device 4 to lock the terminal, the screen is cleared and the characters 'BREAK' appear as shown in (b). Is displayed. Further, if the user enters the password within a predetermined time without any input errors made by a third party more than a predetermined number of times, the screen is displayed as shown in (c) and the work is resumed. Note that no echo back is performed when entering the password.

Note that even if a third party inputs something other than the password in the state of (b), the screen remains as shown in (b), and the echo pack of the screen by pressing the keyboard (input device 4) is not performed.

In addition, if User A does not unlock the device within the time determined by the system after locking the device,
The screen display of the output device 2 of the user terminal 27 is shown as shown in FIG.

In this case, when the terminal lock starts, "B RE A K" is displayed on the screen of the output device 2 as shown in (a). Furthermore, if the terminal lock is not released within the time determined by the system and the process of user A is terminated, the output device 2 screen will display “
5orryjjYour process k
illed, ' is displayed. Along with this display, the screen of the system console output device 11 displays "Winning, User A took" as shown in (c).
to.

An error message "long time to 1ock" is displayed and recorded in the log file.

Further, if the user B locks the terminal and it is about to be illegally unlocked by a third party, a screen display of 2 will be displayed on the terminal's output bag as shown in FIG. 10.

In this case, when the terminal lock starts, "B RE A K"' is displayed on the screen of the output device 2 as shown in (a). If a third party attempts to unlock the device illegally and a password input error occurs when the device is locked, a “Password 1ncor” message will be displayed as shown in (b).
rect,” is displayed.Furthermore, if the user B's process is terminated forcibly and the user B's process is forcibly terminated, if the user B's process fails after repeated attempts to release it and exceeds the limit set by the system.
) as in “You are 5ystea+h
Ucker aren't you, you
"can't log in," is displayed.In addition to this display, the system console output device 1
On the screen of No. 1, “Winning, U” is displayed as shown in (d).
ser B's terminal is h
An error message "i jacked" is displayed and recorded in the system log file.

Effects According to the present invention, when a user works with administrator rights or edits a file containing confidential information, even if the user leaves the terminal, the system cannot be destroyed or destroyed by a third party. It is possible to prevent leakage of confidential matters.

Furthermore, even when a user who has temporarily left the terminal returns, the user can continue working immediately, reducing the hassle of logging out and logging in.

[Brief explanation of the drawing]

FIG. 1 is a functional block diagram of a terminal lock device in an embodiment of the present invention, FIG. 2 is a block diagram of a data processing system in an embodiment of the present invention, and FIG. 3 is a terminal lock in an embodiment of the present invention. Flowchart showing processing of the control unit, 4th
The figure is a flowchart showing the processing of the password character determination section in one embodiment of the present invention, FIG. 5 is a block diagram of the timer control section in one embodiment of the present invention, and FIGS. 6 and 7 are one embodiment of the present invention. FIG. 8 is a flowchart showing the processing of the timer control unit in the example. FIG. 8 is a screen display example showing normal terminal locking in an embodiment of the present invention. FIG. An example screen display when the terminal lock is not released. FIG. 10 is an example of a screen display when the terminal is about to be illegally unlocked by a third party in one embodiment of the present invention. 1: Output control unit, 2: Output device, 3: Output buffer, 4
: input device, 5: input buffer, 6: character control section, 7:
OS kernel, 8: timer control unit. 9: Terminal lock control section, 10: Password determination section. 11 System console output device [, 12: Input control unit, 21 System console, 22: CPU. 23: Main memory (MEM), 24. : Disk controller 1-roller, 25: Disk device, 26: Terminal processor, 27: User terminal, 51: Timer start flag, 52: Time counter, 81: Control unit called from terminal lock control unit, 82: Called from tarlock interrupt control section. Patent applicant Rico Co., Ltd. - No. 4
Figure 7 Figure 7 ^ ^
Ωmouth +7＋＋− 1ρ○

Claims (1)

[Claims] 1. In a data processing system that includes a system console, connects a plurality of user terminals, and performs a plurality of operations, means for determining that a character for controlling the locking of the user terminal has been received, and a means for determining that the user terminal is locked. means for measuring whether a predetermined period of time or more has elapsed since the user terminal was locked, and whether or not the user failed to enter the password a predetermined number of times or more when the user terminal was locked; If a predetermined period of time or more has elapsed since the user terminal was locked, by controlling the means for determining whether the password matches a preset password, the measuring means, and the password determining means, and the user When the device is locked,
If the user fails to enter the password a predetermined number of times, the user terminal forcibly terminates the process, outputs a message to the system console, and records the message in a log file. Upon receiving this, the data processing device suspends input/output to the user terminal, outputs a message indicating that it is in the locked state to the user terminal, and if the password is entered within a predetermined period of time, the data processing device suspends input/output to the user terminal, outputs a message that the user terminal is in the locked state, and if the password is entered within a predetermined period of time, the data processing device stops the input/output to the user terminal, outputs a message indicating that it is in the locked state to the user terminal, and if the password is entered within a predetermined time, the locked state is If the password is released and the input/output control is resumed, and the password is not entered within the specified time, and
A terminal locking device for maintaining confidentiality, characterized in that if a password character input fails a predetermined number of times or more, the process of the user terminal is forcibly terminated, a message is output to a system console, and the message is recorded in a log file. .