JPH02208769A - Checking system for security of information processing system - Google Patents

Abstract

PURPOSE:To prevent the unjust utilization of an information processor by authorizing a user again when terminal equipment is not used for a prescribed time and disconnecting the connection of the terminal equipment and information processor when the authorization of the user is not correctly executed. CONSTITUTION:A time is measured when terminal equipment 1 is not used while the terminal equipment 1 and an information processor 2 are connected, and when the idle time exceeds a prescribed time, an interruption is applied to a job executing part 5, and it is reported. A job execution control part 4 authorizes the user by a user authorizing part 6 before a job requested by a command to be sent next is activated, and when the authorization of the user is not executed, the designated job is activated, and when the authorization is not executed, the user is considered to be an unjust user, the connection of the terminal equipment 1 and information processor 2 is disconnected. Thus, the unjust utilization of the information processor can be prevented.

Description

[Detailed description of the invention] [Industrial application field] This invention is useful not only when starting to use a terminal device.

The present invention relates to a security check method for an information processing system that performs user authentication under predetermined conditions even when a terminal device is in use, and prevents an abandoned terminal device from being used by another user.

[Conventional technology]

Conventionally, as a method of this kind, for example, Japanese Patent Application Laid-Open No. 82-67
There was something like the one shown in Publication No. 658.

FIG. 5 is a block diagram showing the configuration of the security check method of such a conventional information processing system, in which (l) is a terminal device, (2) is an information processing device, and this information processing device (2) is , input/output control unit (3), job execution control unit (4)
), a job execution section (5), and a user authentication section (6). Note that the terminal device (1) processes commands input by the user. The input/output control unit (3) is connected to the terminal device (1
) is sent to the job executed by the user, and the output from the job is sent to the terminal device (1) used by the user. The job execution control unit (4) recognizes user commands and controls the start and end of jobs. The job execution unit (5) actually executes the job. The user authentication section (6) authenticates the user when starting to use the terminal device (1).

In such a system, jobs are executed based on the flowchart shown in FIG.

First, in step (S(51)), the user authentication unit (6) authenticates the user of the terminal device (1).Next.

In step (8152), the command input from the terminal device (1) is passed to the input/output control unit (3) of the information processing device (2).

By the job execution control unit (4) in step (S6S).

The command is interpreted, and the job is executed by the job execution unit (5) in step (864). Such a procedure from step (862) to step (864) is repeated. Therefore, the user of the terminal device (1) is only authenticated at the beginning of use, and is not authenticated thereafter. The information processing device (2) regards all commands input from the terminal device (1) as requests from the same user and executes the job until the connection is severed.

There is also another method as shown in FIG. In FIG. 1, a terminal control (8) is provided between a host computer as an information processing device (2) and a workstation as a terminal device +11.

This terminal control (81 Workstation (1) Workstation Interface (9)
'i connected via terminal control (8)
and the host computer (2) are connected via a communication line αG.

The workstation (1) is equipped with a workstation control section α, a keyboard (I3, a display device cI3 and a 70-bit disk device α-), a floppy disk device (141) and a floppy connection interface (141) and a workstation control section αD. (to).

The terminal control (8) stores a terminal control storage device ae for storing system energy information of the terminal, a security program αη, and a communication program.

Next, the operation will be explained. First, the terminal control (
At the time of system generation in step 8), the user's password is registered in the terminal control storage device I (1).Online users write the same password as the password registered in the terminal control storage device I (1) on the floppy disk.

Set the floppy disk to 0 in the 70x2 disk drive. The security check program αη reads the password on the floppy disk, sets it at the time of terminal control system generation, and compares it with the password on the terminal control storage device (18). Interface (9) t-
Send the communication program to the workstation control unit (111, host computer +2) through the workstation control unit (111). :Starts communication with the workstation control unit (11).

On the other hand, if the passwords do not match if the passwords do not match, the security check program αη will display a workstation control error on the display device (i3) and will not be able to initialize the keyboard az. After initialization, enter the password again for the 70mm disk device I and compare the terminal control storage device.

[Problem to be solved by the invention]

In all of the above security check methods for information processing systems, the user is authenticated at the beginning of using the terminal device, but once a -degree connection is set up,
No user authentication is performed, and jobs are executed assuming that the same user is using the service until the connection is completed. for that.

While the user is temporarily away from the terminal device, the terminal device is improperly used by another user.

There is a problem in that there is a risk that valuable resources such as files owned by the original user and the right to use the information processing device may be infringed.

This invention has been made to solve the above-mentioned problems, and allows the user to connect the terminal device (1) and the information processing device (2).
) If there is an idle time longer than a predetermined time while setting up a connection with the terminal device (1), the user is authenticated and other users are not allowed to use the terminal device (1) to execute a job. The purpose is to provide a security check method for information processing systems that can prevent security problems.

[Means to solve the problem]

A security check method for an information processing system according to the present invention includes an idle time measurement section that measures the unused time of a terminal device connected to an information processing device, and a signal from the idle time measurement section that allows the user to The apparatus includes a user authentication section that performs authentication, and a job execution control section that controls a job execution section based on a signal from the user authentication section.

Further, the present invention uses a host computer as an information processing device, and includes an idle time measuring section between the host computer and the terminal device, a communication means that can connect, freeze, or disconnect communication between the terminal device and the host computer, and a terminal device. The device is equipped with a terminal control having authentication information management means for storing password information for each user who can use the terminal, and authentication means for comparing the stored password with the password input from the terminal device.

[Effect]

The idle time measuring section in this invention measures the time during which the terminal device is not being used while the terminal device and the information processing device are connected, and when the idle time exceeds a predetermined time, interrupts the job execution section. and communicate it. Before starting the job requested by the next command sent, the job execution control section authenticates the user using the user authentication section, and if the user is authenticated, starts the specified job. If the terminal device is not authenticated, it is assumed that the user is an illegal user and the connection between the terminal device and the information processing device is cut off.

Additionally, if the idle time exceeds a predetermined value, the terminal control freezes the connection between the terminal device and the host computer, requests user authentication, and resumes the connection between the terminal device and the host computer if the II verification is performed correctly. However, if the terminal device is not authenticated, illegal use will occur and the connection between the terminal device and the host computer will be severed.

〔Example〕

FIG. 1 is a block diagram of a security check method for an information processing system showing an embodiment of the present invention, and (1) to
(6) is similar to the embodiment shown in FIG. 5 above.

(7) is an idle time measurement section that measures the idle time of the terminal device (1), and sends a signal to the job execution control section that the idle time has exceeded a specified time.

In the system i having such a configuration, a security check is performed based on the flowchart shown in FIG. First, in step (821), user authentication is performed in the same manner as before. When the user is authenticated by this, the terminal device (1) and the information processing device (2) are connected. Here, the idle time measuring section (7) starts measuring the idle time.

In step (822), the input/output control unit (3) of the information processing device (2) obtains the command input from the terminal device (1). The input command is sent to the job execution control section (4). At this time, the presence of key human power is transmitted to the idle time measuring section (7) by a signal, and step (823)
) to the idle time t-t1 measured at In the idle time measuring section (7), t is reached in step (82).
l, that is, the idle time until receiving the input, and -trr specified as the upper limit of the idle time.
, x.

If tl is greater than or equal to tmax, a signal is sent to the job execution control unit (4) in step (825) to request user authentication. In addition, the idle time measurement section performs step (8)
25) To measure the next idle time, tv ft
'J set and return to idle time measurement.

Upon receiving the command, the job execution control unit (4) determines in step (827) whether or not a user authentication request signal has been received. If the signal is coming, step (8)
28) calls the user authentication section (6) to authenticate the user. If the user is authenticated in step (82), the process proceeds to step (8210), where the command is interpreted and the job specified in step (8211) is executed.If the user is not authenticated, an illegal job is executed. In order to prevent the execution, the connection between the terminal device (1) and the information processing device (2) is cut off in step (822).

Therefore, in the security check method of this information processing system, if the user is not using the terminal device, the user is authenticated, and the terminal device is used by another user and a job is executed illegally. It is possible to prevent this from happening. Moreover, it does not have any effect on the user who is using the information processing device continuously9.In addition, in the above embodiment, the idle time measurement section operates independently of the job execution control section; The function can also be incorporated into the job execution control section. In this case, the job execution control unit measures the input waiting time.

Further, even when the information processing device (2) and the terminal device (1) are connected by a telephone line or a communication network, or when communication is performed between a plurality of information processing devices, the same effects as in the above embodiment can be achieved. .

Next, other embodiments of the invention will be described. In this embodiment, a host computer is used as the information processing device. In Figure 3, the terminal control (
8) is connected to the terminal device (1) via the terminal interface (9) and to the host computer (2) via the communication line (11). terminal device (1)
An idle time measurement unit (7) that detects whether the terminal device (1) and the host computer (2) have not been used for a predetermined period of time, a communication means a9 that can connect, freeze or disconnect communication between the terminal device (1) and the host computer (2), and the terminal device. (1) f. Authentication information management means (a) that sets and saves information on users who can use it and passwords for each user; and passwords input from the saved password and terminal device + 1). authentication means r2g for comparison.

Next, the operation of the above embodiment will be explained with reference to FIG. FIG. 4 is a flowchart showing the operation of the system security check.

First, before using the terminal device (1), users who can use the terminal device and passwords for each user are registered in the terminal control (8) using the authentication information manager R.

When a terminal device user uses the terminal device (1) (step (841) in FIG. 4), he first performs an authentication procedure using a password as in the past (step (842) in FIG. 4). ) After obtaining the right to use the terminal device (1), 1 communication means member) host computer (2) g terminal device (
1) is connected via communication line IIIG, and the host computer (2) is used. At the same time, the idle time measuring section (7) starts measuring the idle time (step (S43) in FIG. 4).

While the user is using the host computer (2) using the terminal device T1), the terminal control (8)
The communication means Q9 in ) informs the idle time measuring section (7) of the presence or absence of information to be sent to the terminal device (1) and the empty host computer (2) at regular intervals. The idle time measuring unit (7) is configured to measure the time from the terminal device (1) to the host computer (2).
), it is determined that the terminal device (1) is being used and the idle time measurement is set to zero (step (S44) in Figure 4); however, if no information is being sent, It is determined that the user is not using the terminal device (1), and the idle time is increased (step (845) in FIG. 4).

When the idle time exceeds a predetermined period of time, the idle time measurement unit (7) detects whether the user
If you have determined that the device is no longer in use, please follow the step (84) in Figure 4.
6)) As a result, 0 communication means (19 is the terminal device (1)
and the host computer (2) to freeze the connection (step (847) in Figure 4), and the authentication means 0D authenticates the user (step (84B) in Figure 4). ). The authentication means I2υ obtains the saved password of the current user from the authentication information management means (2) to authenticate the user.

The passwords input by the users are compared (step (849) in FIG. 4). If the passwords match, it is assumed that authentication has been performed correctly. 0 Communication method ae is the terminal device + 1
) and the host computer (2) (step (8410) in Figure 4), but if the user authentication is not performed correctly, the terminal device is judged to have been used illegally. (1) and host computer (2)
) (Step 841 in Figure 4)
1)) Terminate the use of the terminal device (1) (step (8412) in FIG. 4).

In the above embodiment, the terminal control (8) and the host computer (2) are connected via the communication line (II), but this may be done using a dedicated line or a wide area network, and the same connection as in the above embodiment may be used. In addition, in the above embodiment, the system security check function is provided by a terminal control (1) that is separate from the terminal device (1).
8), the same effect as in the above embodiment can also be achieved by incorporating the system security check function realized in the above embodiment into a terminal emulation program for a workstation or the like.

As described above, the above-described embodiment has the advantage that the right to use the system can be checked more strictly independently of the system security check function of the host computer and without making any changes to the host computer.

〔Effect of the invention〕

As described above, according to the present invention, even if a user is using a terminal device, if the user does not use the terminal device for a predetermined period of time, the user is authenticated again. Enables the use of information processing equipment.

If user authentication is not performed correctly, the connection between the terminal device and the information processing device is cut to prevent unauthorized use of the information processing device, and 1. to prevent the use of the resources and information processing device owned by the original user. It is possible to prevent infringement of rights.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing one embodiment of this invention, FIG. 2 is a flow chart showing its operation, FIG. 3 is a block diagram showing another embodiment of this invention, and FIG. 4 is a flow chart showing its operation. , FIG. 5 is a block diagram showing a conventional security check method of an information processing system, FIG. 6 is a flowchart showing its operation, and FIG. 7 is a block diagram showing another conventional method. In the figure, code (1) is a terminal device, and code (2) is an information processing device. (4) is a job execution control section, (5) is a job execution section, (
6) is a user authentication section, (7) is an idle time measurement section, (
8) is a terminal control, (9) is a communication means, 01) is an authentication information management means, and 01) is an authentication means. Note that the same reference numerals in the figures indicate the same or corresponding parts. Figure 1

Claims (2)

[Claims] (1) In an information processing system consisting of an information processing device and a terminal device connected to the information processing device, an idle time measurement unit that measures the time when the terminal device connected to the information processing device is not in use; When the time exceeds a predetermined time, a user authentication section that requires authentication from the user controls the execution of jobs of authenticated users, and suppresses the execution of jobs of unauthenticated users. A security check method for an information processing system, comprising: a job execution control unit. (2) In an information processing system consisting of a host computer as an information processing device and a terminal device connected to the host computer, the password of the terminal device user is registered on the communication path between the terminal device and the host computer. an idle time measuring means that outputs an output when the terminal device user has not used the terminal device for a predetermined period of time; and an idle time measuring means that outputs an output when the terminal device user has not used the terminal device for a predetermined period of time; and a password input by the user and the password storing means according to the output from the idle time measuring means. and a communication means for connecting, freezing, or disconnecting communication between the terminal device and the host computer based on the output from the password comparison means. System security check method.