JPH0334036A - Remote maintenance secret protection system - Google Patents

Abstract

PURPOSE:To protect the secret information, i.e., the property of a user by securing a constitution where a remote maintenance program of a customer computer system checks and monitors the secret of the user property and at the same time transmits the fault information to a maintenance center. CONSTITUTION:The memory dump carried out when a fault occurs in a custom er computer system is diagnosed by a center computer system 102 set at a maintenance center. Under such conditions, a remote maintenance program 103 working in the customer computer system decides whether or not the contents of the memory dump requested by the system 102 are equal to the user secret information registered previously by a customer. Then only the data that are granted for transmission is sent to the system 102 of the mainte nance center. Thus it is possible to prevent the leakage of the secret informa tion, i.e., the user property stored in the customer computer system connected to the system 102 via a communication circuit 104.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to a security protection method for customer property during remote maintenance, and particularly relates to a security protection system for customer property installed in remote locations and a maintenance center. In order to connect customer computer systems with communication lines from the maintenance center to diagnose customer computer systems and provide maintenance services against failures that occur in customer computer systems, while protecting the confidentiality of customer property. The present invention relates to a remote maintenance security method suitable for use in.

[Conventional technology] In general, remote maintenance using conventional technology connects a central computer system installed at a maintenance center and a customer computer system installed at a remote location via a communication line, and the TS
This is done by collecting and diagnosing fault information using ○ (Time Sharing 0ption).

In the above-mentioned remote maintenance, the confidentiality and integrity of customer information is ensured by using a user name (user ID) and password indicating that usage is permitted.
This is done by prohibiting use by unqualified persons, or by password-protecting data sets that are prohibited from access.

The security of the remote maintenance method using conventional technology is as follows:
When a customer system failure occurs, when trying to diagnose the problem from a memory dump, it is impossible to protect the confidentiality of the customer's property in the memory dump, and
It is not possible to monitor the functions executed by the terminal devices of the center IT computer system installed in the maintenance center, and it is not possible to verify the information (log information) seen from the terminal devices. Ta.

In addition, as a conventional technology regarding security protection of remote maintenance method, for example, “Program Product V○S3 AS
The technology described in "SURE User's Guide" (published by Hitachi, Ltd., August 1986) is known.

[Problems to be Solved by the Invention] With the above-mentioned conventional technology, confidential information of user property is leaked from memory dumps, and the customer system cannot monitor the status of maintenance performed based on instructions from the maintenance center. , it has problems such as not being able to verify the content of data sent and received between the customer computer system and the maintenance center, and these problems can lead to leakage of customer information that should be kept confidential. The problem is that it is difficult to prevent this.

An object of the present invention is to solve the problems of the prior art described above, and to provide remote maintenance security that makes it possible to protect confidential information that is user property in maintenance services performed between a customer computer system and a maintenance center computer system. The purpose is to provide a protection method.

[Means for Solving the Problems] According to the present invention, the above object is to install a remote maintenance program in a customer computer system installed in a remote location, and to enable a center computer system installed in a maintenance center to connect a communication line. When collecting fault information that has occurred in a customer computer system connected to the customer computer system, the remote maintenance program in the customer computer system checks and monitors the confidentiality of user assets while transmitting the fault information to the maintenance center. This is achieved by making

[Function] The remote maintenance program running on the customer's computer system will automatically update the computer system of the maintenance center if a memory dump at the time of a failure that occurs in the customer's computer system is diagnosed from the computer system installed at the maintenance center. Regarding the content of the memory dump requested by the customer, it is determined whether the content is confidential user information registered in advance by the customer, and only the data that is permitted to be sent is sent to the computer system of the maintenance center. . As a result, even if the request is based on an instruction from the maintenance center, it is checked whether the data can be transmitted or not, so it is possible to prevent confidential information of user property from leaking from the memory dump.

In addition, the remote maintenance program running on the customer computer system collects and sends fault information and sends diagnostic information based on instructions from the maintenance center, but at that time, this operating status is displayed on the console device. , can be monitored by the customer. This allows the customer to prohibit inappropriate instructions from the maintenance center, thereby preventing leakage of confidential information of user property.

Furthermore, the remote maintenance program running on the customer computer system uses data related to diagnostic information, etc. sent and received from the maintenance center (including legitimate or improper commands from the maintenance center) as log information. Record on a disk device, etc. This makes it possible to verify the content of data sent and received and the progress of data transmission and reception between the customer computer system and the maintenance center computer system.

[Embodiment] Hereinafter, an embodiment of the remote maintenance security system according to the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram illustrating the operation of remote maintenance in an embodiment of the present invention, FIG. 2 is a diagram illustrating security protection for memory dumps, FIG. 3 is a diagram illustrating the format of a memory dump reference request, and FIG. Figure 4 is a diagram explaining the operation of monitoring maintenance execution and collecting log data, and Figure 5 shows the functions necessary for monitoring maintenance execution.
FIG. 6 is a flowchart illustrating security protection operations for memory dumps, and FIG. 7 is a flowchart illustrating maintenance execution monitoring and function cancellation operations. 1 to 4, 101 is a dump data set, 102 is a center computer system, 103 is a remote maintenance program, 104 is a communication line, 105 is a log data set, 106 is a log editing program, and 107 is a log editing output device , 202 is virtual memory space, 203 is user property, 205 is 5YSI, P
ARMLIB data set, 401 is a remote maintenance main task, 402 is a remote maintenance function execution task, 403 is a line control task, 404 is a maintenance center, and 406 is a service processor (SVP).

First, a remote maintenance operation method to which user information security protection according to the present invention is applied will be explained with reference to FIG.

While the customer computer system is executing the business,
Assume that a failure occurs in a customer's computer system. In this case, the customer computer system collects and records a memory dump. The recorded memory dump data is copied as a dump data set 101 that can be used for maintenance. On the other hand, the customer computer system that has finished collecting the memory dump performs a line connection operation to connect with the center computer system 102 in the maintenance center via the communication line 104, and a remote maintenance program 103 that runs within the own system.
Start. The activated remote maintenance program 103 is
A session is established with the maintenance center via the communication line 104, and remote maintenance is executed based on instructions from the center computer system 102.

During execution of this remote maintenance, the remote maintenance program 103
If there is a request to transfer dump data from the center computer system 102, the dump data will be transferred to the center computer system 102. At that time, if there is data registered in advance by the user in the dump data that should be kept confidential, the dump data will be transferred to the center computer system 102. , only the other data excluding the confidential data is transferred to the central computer system.

Further, the remote maintenance program 103 collects commands, data, etc. transmitted and received between the customer computer system and the center computer system for remote maintenance, and generates a log data set 105. The contents of this log data set 105 are edited by a log editing program 106 and output to a log editing output device.

Next, when a customer computer system is remotely maintained by the center computer system 102 of the maintenance center as described above, FIG. , will be explained with reference to FIG.

The customer may prohibit or allow reference to the user property 203 in the memory dump 201 and the maintenance center (job name or space ID) 2.
02 as system data set 5YSI, PARMLIB
205 in advance. Information that can be registered in advance includes, for example, the names 206 of the functions of the remote maintenance program 103 that may be prohibited or permitted to be referenced from the maintenance center; Virtual space ID 207 for which reference may be prohibited or permitted, reference from the maintenance center may be prohibited;
Alternatively, it is composed of a job name 208 that may be allowed to be referenced, and a user property area 209 that is prohibited from being referenced by the maintenance center. The prohibited or permitted areas (206 to 209) specified by these are registered as one entry 211 that can be identified by the type ID 210.

Note that the virtual space ID registered in the entry 211
The virtual space information 207 and the job name 208 may be only one of them.

A maximum of 256 entries can be registered in the entry 211, and additions, deletions, changes, etc. to this entry 211 are as follows:
Using the MODIFY command 212 of the OS command,
This can be done from the console device. Generally, the virtual space information based on the virtual space ID 207 and job name 208 is not fixed, so the MOD I FY command 2
12 and used with modification.

Furthermore, when multiple entries are registered, the last valid entry has a type ID 210 of (FF)l.

An invalid entry due to deletion is 21 depending on its type.
0 is (o 0) 1s.

A dump data reference request from the maintenance center is sent as a reference virtual space ID 301 or a reference job name 302 and a reference area 303, as shown in FIG. PAR
Inside MLIB205! While checking the information added, changed, or deleted by the record effector 211 report and the MODI FY command 212 with the request information, only the information that is allowed to be referenced is sent to the maintenance center.

Next, the security protection operation for memory dump will be explained with reference to the flowchart shown in FIG.

<1) Remote maintenance program 103 on customer computer system
When execution starts, first, 5YSI.

Reference prohibited area registration information is input from the PA, RML IB 205 (step 601).

(2) When a memory dump reference request is sent from the maintenance center, the reference request is fetched from the 5VP 406 (step 602).

(3) Check whether the reference request information from the maintenance center is valid or not.
This is determined by comparing the information of all registered entries 211 in 05 (steps 603, 604, 607).
．． 608).

(4) In step 604, if the reference request information from the maintenance center is a user property in a reference prohibited area, a report of non-reference is notified to the maintenance center via the 5VP 406 (step 610).

(5) If the reference request from the maintenance center is valid for all entries in step 607, extract the area for which the reference request was made from the dump data set 101;
The data is sent to the maintenance center via the 5VP 406 (step 609).

One embodiment of the present invention operates as described above in response to a request for memory dump information during remote maintenance, so that confidential information of user property can be prevented from leaking to the maintenance center.

Next, with reference to FIGS. 4 and 5, monitoring of the remote maintenance execution function and collection of log data of transmitted and received data will be described.

Remote maintenance program 1 that operates within the customer computer system
03 is composed of three tasks, namely, a remote maintenance main task 401, a remote maintenance function execution task 402, and a line control task 403, as shown in FIG.

A remote maintenance main task 401 generates a remote maintenance function execution task 402 and a line control task 403, and performs overall control and MODI FY/FY input from the console device.
5 Executes TOP command processing. The remote maintenance function execution task 402 receives a command (P
The OS T) executes the functions requested from the maintenance center 404. At this time, remote maintenance function execution task 40
2 registers the state of the execution function and the process currently being executed, for example, the open process of the dump data set 101, the input process, etc., in the execution function monitoring table 501 shown in FIG.

This execution function monitoring table 501 includes execution function name 502
, the name of the process being executed 503 and the name of the data set being processed 504
The remote maintenance main task 401 monitors its status and handles requests for displaying and canceling execution functions using the MODIFY command.

By inputting the MODIFI command from the console device, the customer can display and monitor the status of maintenance execution, and depending on the status of the maintenance execution, it is possible to cancel the maintenance execution. can.

When requesting cancellation, the remote maintenance main task 401 notifies the remote maintenance function execution task 402 of this as a cancellation command (PO3T).

The line control task 403 includes a 5VP 406 and a communication line 40.
7, the customer computer center and the maintenance center 404 are connected, receives and receives requests from the maintenance center, and notifies the remote maintenance function execution task 402 of the requests from the maintenance center (PO3T). Further, when the line connection task 403 receives a reply to the above-mentioned request from the remote maintenance function execution task 402, it transmits this information to the maintenance center 404.

All of the data transmitted and received between the maintenance center 404 and the customer computer system as described above is recorded and saved in the log data set 408. This results in
Later, it becomes possible to verify the transmitted and received data when performing maintenance.

Next, the operation of monitoring the remote maintenance function and canceling the function described above will be explained with reference to the flow shown in FIG.

(1) Remote maintenance main task 401 is to cancel and monitor (display) the remote maintenance function using the MODIFY command.
When the command is given, it is checked whether the command is a cancellation request (step 701).
~703).

(2) In step 703, when a function cancellation request is instructed by the MODIFY command, a cancellation request is sent to the remote maintenance function execution task 402 to cancel the function being executed by the remote maintenance function execution task 402. (step 705).

(3) Also, in step 703, when a request for monitoring (displaying information about the executed function) is made by the MODIFY command, the function execution routine (executed from the executed function monitoring table (step 714) created in step 713) is executed. Information regarding the function is obtained, and the function name and processing status (name of the data set being used) are displayed on the console (step 704).

Through the above operations, the remote maintenance main task 401 can monitor remote maintenance operations from the maintenance center.

(4) The remote maintenance function execution task 402 starts (ATTACH) a function execution routine in response to a function execution request from the line control task 403 (steps 706 to 708
).

(5) The function execution routine includes the execution function name and processing status m(
The name of the data set being used) is registered in the execution function monitoring table, and the remote maintenance function instructed by the maintenance center 404 is executed (steps 713 to 715).

(6) If a function cancellation notification is received from the remote maintenance main task 401 in step 705 while the above-described function execution routine is in operation, the function execution routine is forcibly terminated (DETACH), and at the same time the line control task 40
3 of the cancellation (steps 710 and 711).
).

(7) If the function execution routines 713 to 715 are successfully completed without receiving the function cancellation notification from step 705, the remote maintenance function execution task 402 notifies the line control task 403 of the normal termination of the function (PO3T
) (step 712).

(8) The line control task 403 accepts instructions from the maintenance center via the 5VP 406, starts the remote maintenance function execution task 402 to execute the requested function, and executes the task (steps 706 to 712). ) (steps 716-718).

(9) Wait for the completion of execution of the remote maintenance function execution task 402, receive the execution result, and transmit the remote maintenance function execution result received via the 5VP 406 to the maintenance center 404 (steps 719 and 720).

One embodiment of the present invention can monitor maintenance operations during remote maintenance and cancel the maintenance operations as necessary through the processing described above, so that confidential information that is the user's property can be protected. It is possible to prevent information from being easily leaked to the maintenance center.

[Effects of the Invention] As explained above, according to the present invention, leakage of confidential information that is user property stored in a customer computer system connected to a center computer system of a maintenance center via a communication line is prevented. This makes it possible to fully rely on the maintenance center for maintenance such as investigating the causes of failures in the customer computer system.It also has the effect of preventing leaks of confidential information, thereby improving the reliability of the customer computer system. It is possible to improve the

[Brief explanation of drawings]

FIG. 1 is a diagram illustrating the operation of remote maintenance in an embodiment of the present invention, FIG. 2 is a diagram illustrating security protection for memory dumps, FIG. 3 is a diagram illustrating the format of a memory dump reference request, and FIG. Figure 4 is a diagram explaining the operation of monitoring maintenance execution and collecting log data, and Figure 5 shows the functions necessary for monitoring maintenance execution.
FIG. 6 is a flowchart illustrating security protection operations for memory dumps, and FIG. 7 is a flowchart illustrating maintenance execution monitoring and function cancellation operations. 101...Dump data set, 102...
...Center computer system, l○3...Remote maintenance program, 1.04...Communication line, 105
...Log data set, 106...Log editing program, 107...Log editing output device, 202...Virtual memory space, 203...
...User property, 205...5YS1, PA
RMLIB data set, 401...Remote maintenance main task, 402...Remote maintenance function execution task, 403...Line control task, 404...
...Maintenance Center, 4.06...Service Processor (SVP). No.! Figure 3 Figure 4 Figure 5N

Claims (1)

[Scope of Claims] 1. In a remote maintenance method in which a customer computer system is connected to a central computer system of a maintenance center via a communication line, a memory dump related to a failure that has occurred in the customer computer system is transmitted to the computer of the maintenance center. When diagnosing from the system, only other memory dump information is sent to the maintenance center, excluding areas where confidential information that is user property is prohibited from being read from the maintenance center, or information in a predetermined area of the entire space. A remote maintenance security method characterized by sending data to a computer system. 2. In a remote maintenance method in which a customer computer system is connected to a center computer system of a maintenance center via a communication line, when the customer computer system is diagnosed by the computer system of the maintenance center, the customer computer system is connected to a center computer system of a maintenance center. A remote maintenance security system is characterized in that it is possible to monitor and display the execution status of commands from a system, as well as to prohibit and interrupt diagnostic operations. 3. In a remote maintenance method in which the customer computer system is connected to the center computer system of the maintenance center via a communication line, data sent and received between the customer computer system and the center computer system is recorded as log data. Features a remote maintenance security system. 4. A remote maintenance system comprising at least two of the remote maintenance security systems set forth in claim 1, 2, or 3.