JPH0259952A - Protection system for access right information - Google Patents

Abstract

PURPOSE:To remove danger leaking access right information from output contents by outputting the access right information by a format substituting prescribed characters such as spaces for the information at the time of outputting the contents of procedure description stored in a file from an output device. CONSTITUTION:At the time of storing the procedure description including access right information applied from a user in a file 3, a syntax analyzing means 2 detects the access right information included in the procedure description and adds a control character indicating its existing position. At the time of outputting the procedure description stored in the file 3 from the output device 4, a protection means 6 detects whether the control character exists in the outputted procedure description or not, and at the time of existence, substitutes the prescribed character for the access right information existing in the position indicated by the control character to disable the information to be identified. Consequently, the access right information can be prevented from being known by a third person at the time of outputting the procedure description.

Description

[Detailed Description of the Invention] [Field of Industrial Application] The present invention relates to a method for protecting access right information in a computer system, and in particular to a method for protecting access right information in a computer system. The present invention relates to a protection method for access right information that protects the access right information from being learned by a third party when outputting from an output device.

[Conventional technology]

Various methods have been proposed or put into practice as security protection methods for computer systems, but one of them is the access right information declared by the user and the corresponding access rights managed within the system. There is a method in which the information is compared, and if they match, the use of the computer system itself or individual files is permitted, and if they do not match, the use is denied. Specifically, this method is configured as follows.

-C, computer system users create procedural descriptions that instruct the computer system to perform tasks, using a job control language for punch jobs and a command language for conversation processing such as TSS. By inputting this into the system, the computer system is asked to perform the desired work. At this time, the user declares access right information consisting of a user name and password in a job declaration statement in a procedure description written in a job control language or command language,
By comparing these with the corresponding access right information managed within the system, it is determined whether the user is authorized to use the computer system. In addition, file-based security protection is achieved by declaring access rights information consisting of a password in the file declaration statement in the above procedure description, and comparing this with the corresponding internal access rights information. This is to determine whether or not a person can use the file.

The above-mentioned security protection method that uses access right information is a method that can withstand practical use, but its drawback is that if the access right information is learned by a third party, it can easily be used illegally. It is to put it away.

Therefore, it is desirable that access right information be managed so as not to be seen by third parties.

[Problem to be solved by the invention]

By the way, in order to make the computer system even more convenient, the above procedure description given by the user is stored in a file, and later when the user requests it, the procedure description stored in that file can be retrieved. There is a computer system that has a function to output the information to the user. Such functions enable the user to reuse procedural descriptions, and to correct errors found through debugging using the original procedural description.

However, if a computer system with such a file output function also employs the above-mentioned security protection method based on access right information, it is difficult to keep the access right information confidential because it has the file output function. Become. In other words, access rights information such as user name and password set in the procedure description stored in the file is stored in the file l The results are easily visible to third parties.

The present invention has been made in view of these circumstances,
The purpose of this is that if access right information exists in a procedure description stored in a file, when that procedure description is output,
An object of the present invention is to provide a protection method for access right information that protects the access right information from being known by a third party.

[Means to solve the problem]

In order to achieve the above objectives, the access right information protection method of the present invention provides a security protection function by comparing the access right information given by the user with the corresponding access right information managed within the system. , a computer system having a function of storing a procedural description including the access right information given by the user in a file, and outputting the procedural description stored in the file from an output device at a request from the user. When storing a procedure description including the access right information given by the user in the file, detecting the access right information included in the procedure description and indicating the location of the detected access right information. a syntax analysis means for adding a control character; and a syntax analysis means for detecting the presence or absence of the control character when outputting the procedure description stored in the file from the output device, and detecting the presence or absence of the control character, and detecting the existence of the control character at a location indicated by the detected control character. and protection means for replacing the access right information with predetermined characters.

[Operation] In the access right information protection method of the present invention, when storing a procedure description including access right information given by a user in a file, the parsing means extracts the access right information included in the procedure description. Detects and adds a control character indicating its location, and when outputting a procedure description stored in a file from an output device, the protection means detects whether or not the control character exists in the procedure description to be output. However, if the access right information exists at the location indicated by the control character, it is replaced with a predetermined character to make it unidentifiable.

[Example] Next, an example of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, a computer system according to an embodiment of the present invention includes a job control language/conversation processing command language creation means (hereinafter abbreviated as creation means) 1, a syntax analysis means 2.
Storage file 3. Output dryer 4. Protection mechanism 6. It includes a printer 7 installed within the computer system and a terminal device 8 installed at a remote location via a line. Further, the output driver 4 has a protection mechanism calling means 5, and the protection mechanism 6 has an access right information detection means 61 and a character 1tA means 6-2.

A user of a computer system instructs a computer to perform a job using a job control language for patch jobs and a command language that describes commands as procedures for conversation processing.

The creation means 1 supports the creation of procedural descriptions written in these languages, and this is specifically realized by an editor, library management program, etc. The creation means 1 calls the syntax analysis means 2 when storing the created procedure description in the storage file 3, which is a user file, according to a user's instruction.

The syntax analysis means 2 performs a process of parsing a procedure description written in a job control language or a command language to detect access right information such as a user name and password written in a statement in that language. Processing to separate the access right information from other information by adding a predetermined control character after the character string constituting the access right information, and processing to store the procedure description processed in this way in the storage file 3 are performed. It is a means. Here, the reason why control characters are added to the access right information is to enable the protection mechanism 6 to detect the access right information.

The output driver 4 outputs the contents stored in the storage file 3 to the printer 7 in the system in response to a request from the user.
This is means for printing on paper or displaying on the display device of the terminal device 8. Generally, in addition to the character data that constitutes the procedure description, the storage file 3 also stores various data compatible with multimedia, such as graphic data and image data, and data other than the procedure description, including access rights information, is protected by a protection mechanism. There is no need to perform the process for hiding according to 6. Therefore, when output is requested by the user, the output driver 4 reads the requested content from the storage file 3, adds it to the protection mechanism calling means 5, and determines the content of the file for which access right information should be hidden. Let them identify whether or not. The protection mechanism calling means 5 determines whether the current file content is character data related to a procedure description by, for example, decoding the record control word in the file.
In the case of character data related to a procedure description, the file contents are passed to the protection mechanism 6 and activated.

When the processed procedure description is returned from the protection mechanism 6, it is output to the designated printer 7 or terminal device 8. In addition, in the case of data other than procedure descriptions,
The output driver 4 outputs the data to the designated printer 7 or terminal device 8 without going through the i mechanism 6, as in the conventional case.

The protection mechanism 6 detects the presence or absence of a control character by analyzing the procedure description passed from the protection mechanism calling means 5, and replaces the access right information present in the location indicated by the detected control character with a predetermined character. This is a means for returning the procedure description to the output driver 4, which is the request source. For this,
The security mechanism 6 includes an access right information detection means 6-1 which detects the existence of access right information by identifying control characters added by the syntax analysis means 2 in the data passed from the security structure calling means 5. , access right information detection means 6
A character replacement means 62 that first deletes the control characters detected in step -1 and the characters constituting the access right information, and then replaces the access right information part with a predetermined character such as a blank character. We are prepared.

Referring to FIG. 2, an example of the procedure description 20 created by the creation means 1, an example of the procedure description 21 when it is processed by the parsing means 2 and stored in the storage file 3, and the storage file 3 Procedure description 21 read from
An example of the procedure description 22 at a time after the data has been input to the protection mechanism 6 via the output driver 4 and processed by the protection mechanism 6 is shown. As shown in the procedure description 20 in the figure, the procedure description created by the creation means 1 includes access right information (in this example, file protection password) is written. When this procedure description 20 is passed to the syntax analysis means 2, the syntax analysis means 2 analyzes the character string "rpassword" as access right information, and as shown in the procedure description 21, predetermined control characters are added before and after it. column (in the example in the same figure,
*) is added and stored in storage file 3. After that, the user uses his/her own file, storage file 3, to correct errors found through debugging.
When the above procedure description 21 stored in the printer 7 is requested to be output from the printer 7 or displayed on the terminal device 8, the output driver 4 reads the procedure description 21 from the storage file 3.

Then, when it identifies that the character data is related to a procedure description and passes the procedure description 21 to the protection mechanism 6, the protection mechanism 6 converts the character string "*password*" into a predetermined character (the example shown in Figure 2). Then, the character string r*** consisting of "*")
A procedure description 22 converted to ``*****'' is created and returned to the output driver 4.

The output driver 4 outputs this to a designated printer 7 or terminal device 8.

(Effects of the Invention) As explained above, in the access right information protection method of the present invention, even if access right information such as user name and password is included in the procedure description stored in the file, When outputting the content from the output device, the access right information is output in a format in which predetermined characters such as blanks are substituted, so there is no risk of the access right information being leaked from the output content. In this way, by protecting the access rights information that should be protected from being seen by others, even at a seemingly blind spot, such as when the procedure description stored in a file is output, it is possible to protect the computer system itself and its usage. The security of personal files, etc. can be further strengthened.

[Brief explanation of the drawing]

FIG. 1 is a block diagram of an embodiment of the present invention, and FIG. 2 is an explanatory diagram of the operation of the embodiment of FIG. In the figure, l... Job control language/conversation processing command language creation means (creation means) 2... Syntax analysis means 3... Storage file 4... Output driver 5... Protection mechanism calling means 6. ...Protection mechanism 6-1...Access right information detection means 6-2...Character replacement means 7...Printer 8...Terminal device 20...Procedure description at the time of creation by creation means 1

Claims (1)

[Claims] Includes a security protection function by comparing access right information given by a user with corresponding access right information managed within the system, and the access right information given by the user. In a computer system having a function of storing a procedural description in a file and outputting the procedural description stored in the file from an output device upon a request from the user, the access right information given by the user is a syntax analysis means for detecting access right information included in the procedure description and adding a control character indicating the location of the detected access right information when storing the included procedure description in the file; protection means for detecting the presence or absence of the control character and replacing the access right information existing in a location indicated by the detected control character with a predetermined character when outputting the procedure description written in the output device from the output device; A protection method for access right information, characterized by having the following.