JPH0353369A - Secret protection system - Google Patents

Abstract

PURPOSE:To prevent an illegal user from giving an illegal access to an information processor by providing a means which stores plural pieces of the personal information on users and a means which collates the personal information received from the user with that stored in the storage means and allows the user to use the information processor only when the coincidence is obtained between both personal information. CONSTITUTION:The personal information on a user including his/her height, data of birth, blood type, the native place, etc., are previously stored and registered in a storage means. When the user uses an information processor, the user inputs the whole or a part of his/her personal information as long as the input user ID and password are correct. Otherwise an input instruction means can produce an instruction for input of the whole or a part of the personal information. A use grant means collates the registered personal information on the user with the personal information received from the user and decides a due user only when the coincidence is obtained between both personal information. Thus the user is allowed to use the information processor and it is possible to prevent an illegal user from giving a illegal access to the information processor.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to an information processing device, and particularly to a security system suitable for preventing leakage of confidential data.

[Conventional technology]

The prior art will be explained using the flowcharts of FIG. 10 and FIG. 0:M11.

Generally, when a user uses a highly confidential information processing device, he or she often inputs a user ID and password using a keyboard or the like. The user ID is information that determines whether the user can use the information processing device,
The password is information for determining whether or not an authorized user is attempting to use the information processing device.

When the user enters the user ID manually, the information processing device compares the registered user ID with the input user ID. If the user IDs match, a password is then input and the registered password is compared with the input password.

If the passwords match, the user can normally use the information processing device and perform the work he or she wants.

For example, if the registered user ID is "SAITOH",
If the registered password is ``YES'',
As shown in the display screen shown in Figure 10 (1), the user enters ``SAITOH'' as the user ID and @ as the password.
If you do not input ``YES'' correctly, you will not be able to access the information processing device to edit files or run programs.Also, if the user ID or password is not input correctly, please refer to Figure 10 ( 2)
As shown in , a message is displayed on the screen to prompt the user to re-enter the user ID or password, and if they do not match again, to cancel permission to access the information processing device.

[Problem a that the invention attempts to solve]

In the above conventional technology, an unregistered user (unauthorized user)
Another problem is that if the user ID and password of a registered user are known, unauthorized access to the information processing device (such as illegally obtaining or destroying files) can be freely performed.

An object of the present invention is to prevent unauthorized users from unauthorized access to the information processing apparatus and to ensure confidentiality protection.

[Means to solve the problem]

In order to achieve the above object, the security scheme of the present invention is as follows:
An information processing device including a central processing unit, an input unit, a display unit, a main memory, and an external storage unit, including a means for storing a plurality of pieces of personal information unique to a user, and a means for storing personal information input by the user. and means for comparing the personal information stored in the storage means and permitting use of the information processing device if both match.

The present invention also provides means for storing a plurality of user-specific personal information in an information processing apparatus that includes a central processing unit, an input section, a display section, and a main memory, and that can be connected to an external storage section. , a means is provided for comparing personal information input by a user with personal information stored in the storage means, and prohibiting use of the information processing device if the two do not match.

The use prohibition means prohibits input from the input section, prohibits access to the main memory or the external storage section, and prohibits display on the display section.

Further, the present invention is provided with means for instructing the user to input all or part of the personal information from the input section, and the input instruction means allows the user to input all or part of the personal information from the input section each time the main memory or the external storage section is accessed. , all or part of the personal information is input from the input section when accessing the main memory or the external storage section, or when accessing important data in the external storage section. It is also possible to instruct the user. moreover,
The input instruction means can also switch the personal information to be input each time an instruction is given.

[Effect]

In the security protection method of the present invention, height, date of birth, etc. blood type,
Personal information unique to the user, such as place of birth, is stored and registered in a storage means in advance. If the user ID and password input by the user when using the information processing device are correct, the user inputs all or part of the personal information. Note that here, the input instruction means may instruct the user to input all or part of the personal information.

The usage permission means compares the registered personal information of the user with the personal information input by the user, and only if the results of this match match, determines that the user is a valid user,
Permit use of information processing equipment.

On the other hand, the use prohibition means performs the same verification as the above-mentioned use permission means, and if it is determined that the user is not an authorized user, the use prohibition means may be used to prohibit input from the keyboard, access to files in an external storage device, CRT, etc. prohibited from displaying.

Therefore, it is possible to prevent the information processing device from being used illegally by an unauthorized user.

In addition, even if the information processing device is being used normally by verifying the user ID, password, and personal information, each time an arbitrary file is accessed, the verification process is performed by instructing the user to input personal information. By doing
It is possible to prevent files from being illegally used or destroyed by unauthorized users.

Also, when accessing a specific file,
By instructing the user to input personal information and performing verification, it is also possible to limit the users who can access files that are particularly important for iL.

As described above, the present invention not only performs verification using the user ID and password, but also performs verification based on personal information and performs a double and double check. Unauthorized access to W can be prevented.

Furthermore, each time the user attempts to access the information processing device, the personal information that the user is instructed to input is switched and the user is required to input different personal information each time, thereby preventing unauthorized access to the information processing device by unauthorized users. becomes more certain.

Incidentally, instead of checking by user ID and password, it is possible to prevent unauthorized access to the information processing device by unauthorized users by simply checking by personal information, but in this case, height, date of birth, When looking at one type of personal information such as blood type and place of birth, there is a possibility that there are many other pieces of personal information that are the same.
It is desirable to input two or more pieces of personal information at a time.

〔Example〕

Hereinafter, one embodiment of the present invention will be described with reference to the drawings.

FIG. 9 is a block diagram showing the configuration of an information processing apparatus to which the present invention is applied. In the middle, 1 is the CPU (central processor unit), 2 is the main memory, 3 is the external storage FDC/HDC (floppy disk controller/hard disk controller), and 4 is the FDD/HDI.
) (floppy disk driver/hard disk driver), 5 is KINTC (keyboard interface controller), 6 is keyboard, 7 is CRTC (cathode ray display tube controller), 8 is CRT (cathode ray display V) which is the display section, 9 is CPU It's a pass.

Next, the operation of one embodiment of the present invention will be explained with reference to FIGS. 1 and 3.

The currently registered user ID is ``SAITOH'',
The password is "YES", and the registered personal information is that the height and name are "173" and "k" respectively.
m”.

First, as shown in FIG. 1, the information processing device
A message "Please enter your user ID" is displayed on the CRT 8, requesting the user to enter the user ID. The user inputs the user ID using the keyboard 6.

The information processing device compares the input user ID with a registered user ID and checks whether the correct user ID has been input. If the correct user ID is entered, the information processing device displays the message "Please enter your password" on the CRT, as shown in Figure 1.
8 and requests the password to be entered. The user is
As with the user ID, enter the password on the keyboard 6.
Enter more information.

The information processing device compares the input password with a registered password to check whether the correct password has been input. If the correct password is entered, the information processing device displays the message "Your height is ↑" on the CRT 8, as shown in Figure 1.
Request the user's height. User is user ID
and password, as well as the user's own height.

The information processing device compares the input height data with registered height data to check whether correct height data has been input. If the correct height data is input, the information processing device displays the message "What is your name?" on the CRT 8, as shown in FIG. 1, and requests the user to input the user's name. The user enters their name.

The information processing device compares the input name data with the registered name data and checks whether the correct name data has been input. If the correct name data is input, the information processing device determines that the user is a legitimately registered user, and permits the user to perform operations such as file editing and program execution.

That is, in order to perform work on the information processing device, the user must enter the user ID. Please enter your password and personal information in "S"
AITOH""YES","'173"..1Kenichi"
They must be entered in the correct order.

If the user ID. If either the password or the personal information does not match, the user is asked to input the password again, and if they do not match again, a message is displayed on the CRT 8 to stop access to the information processing device.

In this way, compared to the conventional technology where only the user ID and password are input and checked, since the user's unique personal information can also be checked, unauthorized use of the information processing device by unauthorized users can be prevented, and the information processing device It is also possible to prevent theft or destruction of important files in the external storage section of the computer.

In addition, in the embodiment, a case where two types of personal information are inputted has been described, but it may be 1N1 type or 3 types or more.

Next, the process when the personal information input by the user and the registered personal information do not match will be explained using FIG. 4, FIG. 5, FIG. 6, and FIG. 8.

FIG. 4 shows an embodiment in which keyboard input is prohibited when the input personal information does not match the registered personal information t'4. Similar to the first embodiment described above, the registered user ID, password, and person information are ``SAITOI{''@YES''``173''.
It is assumed that the name is ``Kenichi.'' In FIG. 4, in this embodiment as well, the input user ID. Check for unauthorized users by comparing passwords and personal information with registered data.

For example, if an unauthorized user knows the user ID and password of a legitimate user, the user ID "
SA I TOI {'' as the password and ``YES''
' can pass the unauthorized user check using user IDk and password.

However, unauthorized users cannot correctly input personal information of authorized users. In other words, even if the information processing device displays the message "Your height is i" on the CRT 8 and requests input of height data, even if you enter random data, such as ``180'', the registration will not work. Some personal information is "@173", so there is no match. In this case, the information processing apparatus determines that an unauthorized user is attempting to perform unauthorized access, and performs processing to prevent input from the keyboard 6, as shown in FIG.

In this way, personal information is collated to check for unauthorized access to the information processing device by an unauthorized user, and processing to prevent continued unauthorized access is performed to prevent confidential information from being leaked.

FIG. 5 also shows that when the input personal information and the registered personal t1v information do not match, that is, when the information processing device determines that unauthorized access is being performed, the main memory and external storage An example of prohibiting access to is shown.

Similarly, FIG. 6 shows an embodiment in which display on the display section is prohibited.

Processing to prohibit keyboard input and access to main memory and external storage. Specifically, as shown in FIG. 8, the process of prohibiting display on the display unit is performed by
is FDC/}{DC 3 , KINTC 5 , CRT
Control signal 10 is output to C 7, and FD
Access to the D/HDD 4, acceptance of access from the keyboard 6, and display on the CRT 8 may be masked.

For example, if you do not want to perform a keyboard interrupt from the keyboard 6 to the CPUI, the CPU will use the control signal 10 to
Control 5.

Above, Figure 4. According to the embodiments shown in FIGS. 5 and 6, unauthorized access to the information processing apparatus by unauthorized users can be prevented. Furthermore, a prohibition process that combines these embodiments may be performed.

Next, as in the first embodiment above, the correct user ID
．． Even if a password and personal information are entered and access to the information processing device is permitted to edit files in the main memory or external storage or execute programs, it is still possible to execute arbitrary files. An embodiment in which an unauthorized user is checked for each case will be described with reference to FIGS. 2 and 7.

As in the first embodiment described above, first, the input user ID. Check for unauthorized users by comparing passwords and personal information with registered data.

For example, if an unauthorized user knows the user ID, password, and personal information such as height and name of a legitimate user, enter "SAITOW" as the user ID and "YES" as the password. Passed the ID and password check for unauthorized users, and entered ``''l736 as the height data and @ as the name data.
Access to the information processing device is permitted by entering "Kiichi" and passing the unauthorized user check based on personal information. However, in this embodiment, the file USERI
, USER2. When executing USER3, a message is displayed on the CRT 8 to request personal information to be input each time an arbitrary file is to be executed. Then, the input personal information data is compared with the registered personal information data, and unless they match, the file cannot be intercepted. For Figures 2 and 7, file USE
When attempting to execute R1 and USER3, the user is asked to input data such as Ayu's date of birth and place of birth as personal information, respectively.

Therefore, the unauthorized user cannot correctly input the personal information of the authorized user. That is, for example, when attempting to execute USER3, even if the information processing device displays the message "Where are you from?" on the CRT 8 and requests input of birthplace data, it will display random data, e.g. Even if you enter “America”! This cannot be executed because it does not match the recorded personal information.

In addition, if the entered personal information does not match the registered personal information, keyboard input may be prohibited, external storage Processing may also be performed to prohibit access to the memory or to stop displaying on the display unit.

In this way, in this embodiment, the user ED. By correctly inputting the password and personal information, it is possible to prevent unauthorized users who are permitted to access the information processing device from illegally accessing files on the external storage unit or the main memory.

Note that in this embodiment, the file USERI. USER
2. USER 3 (7) When attempting to execute Uchi no USER 2, no checks are made for unauthorized users, but each time a user accesses every file, personal information is requested and verified. You can.

Additionally, personal information can be requested and verified only when accessing highly confidential files. In this case, users who can access specific files can be restricted.

Furthermore, as shown in FIG. 12 (1), each time the information processing device is used, the personal information that is requested to be input can be changed and the verification can be repeated. Also, Figure 12 (2
), it is also possible to check for unauthorized access caused by unauthorized user I by simply verifying personal information without using the user ID or f password.

〔Effect of the invention〕

As explained above, according to the present invention, a double check is performed in which verification is performed based on the user ID and password, and further verification is performed using personal information. This has the effect of preventing unauthorized access and leakage of confidential information.

Furthermore, it is possible to prevent unauthorized users who are permitted to access the information processing device from accessing files on the external storage unit or main memory.

Furthermore, by checking a specific file using personal information, it is possible to limit the users who can access highly confidential files.

[Brief explanation of drawings]

Figure 1. Second prisoner. Figures 3 and 4. 5, 6, 7, and 12 are diagrams for explaining embodiments of the present invention, FIG. 8 is the configuration of an information processing device for explaining prohibition processing, and FIG. 9 is for information processing. Configuration diagram of the device, Figure 10 and Figure 1
FIG. 1 is a diagram explaining the prior art. 1...CPU 2...Main memory 3.
・・FDC/HDC 4・・FDD/HDD5・
・KINTC6...Keyboard 7...CRTC 8...CRT9...
Bus 10...Control signal CRT8 display L! J side 45 figures Punishment 4 figures 45 figures Kaya G figure 7 figures 411 figures

Claims (1)

[Claims] 1. A security protection system for an information processing device that includes a central processing unit, an input unit, a display unit, and a main memory, and can be connected to an external storage unit, which means for storing personal information, and comparing the personal information input by the user with the personal information stored in the storage means,
1. A security protection system comprising: means for permitting use of the information processing device when both match. 2. A security protection system for an information processing device that includes a central processing unit, an input section, a display section, and a main memory, and can be connected to an external storage section, and stores a plurality of user-specific personal information. and comparing the personal information input by the user with the personal information stored in the storage means,
A security protection system characterized by providing means for prohibiting use of the information processing device if the two do not match. 3. The security system according to claim 2, wherein the use prohibition means prohibits input from the input unit. 4. The security system according to claim 2 or 3, wherein the use prohibition means prohibits access to the main memory or the external storage section. 5. The security protection system according to claim 2, 3 or 4, wherein the use prohibition means prohibits display on the display unit. 6. The security protection system according to claim 1, 2, 3, 4 or 5, further comprising means for instructing the user to input all or part of the personal information from the input section. 7. The input instruction means is configured to perform an input command each time the main memory or the external storage section is accessed, or upon any access to the main memory or the external storage section;
When accessing important data in the external storage unit,
7. The security protection system according to claim 6, wherein the user is instructed to input all or part of the personal information from the input section. 8. The input instruction means inputs the personal information to be instructed to input,
8. The security protection method according to claim 6, wherein the security protection method is switched each time an instruction is given.