JPH04252350A - Security check method - Google Patents

Abstract

PURPOSE:To attain the security check for the positive detection of illicit users. CONSTITUTION:A computer 31 adds its terminal ID 9 to a user ID 7 and a password 8 inputted from a terminal 61 for improvement of the security and then sends the ID 7, the password 8 to a host computer 2. The computer 2 compares these received ID 7, password 8 and ID 9 with the ID 7, the password 8 and the ID 9 which are previously registered. If the coincidence is obtained between the ID 7 and the password 8 inputted from the terminal 61 and the registered ID 7 and password 8 and no coincidence is obtained between the ID 9 added through the terminal 31 and the registered ID 9 respectively, the computer 2 permits the illicit users to have accesses in a prescribed range and to continuously use the computers. Meanwhile the computer 2 checks the illicit users.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] Concerning security checking methods.

0002

[Prior Art] The conventional method is disclosed in Japanese Patent Application Laid-Open No. 2-208770.
As stated in the publication, unauthorized intrusion was prevented by strengthening security checks.

0003

[Problem to be Solved by the Invention] The purpose of the above-mentioned conventional technology is to prevent unauthorized users, but no consideration is given to discovering unauthorized users, making it impossible to locate unauthorized users. There was a problem.

An object of the present invention is to provide a security check method for actively discovering unauthorized users.

[0005]

[Means for solving the problem] In order to achieve the above object, security is strengthened by adding second security information held by the second computer to third security information input to the second computer. and then transmits it to the first computer. The first computer receives the first security information registered in advance and the received second and third security information.
Compare security information. The first computer determines that the third security information entered into the second computer matches, but the second
If the security information does not match, the unauthorized user will be notified, and the unauthorized user will be allowed access within a pre-specified range, and use will continue, during which time the unauthorized user will be investigated.

[0006]

[Operation] A check at the start of a session is that the third security information input to the second computer and the second security information added by the second computer are sent to the first computer, and the third security information input to the second computer is sent to the first computer. It is confirmed whether the security information matches the first security information registered in . Even if the third security information entered into the second computer matches, but the second security information added by the second computer does not match, the user is allowed to connect and continues to use it. The first computer issues a warning to allow time for investigation.

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be explained in detail below with reference to the drawings. FIG. 1 is a configuration diagram of a network system according to an embodiment of the present invention. The network system consists of a host computer 2 and a plurality of computers 31, 32, . . . 3n connected by a network 1. The host computer 2 has a security master file 4. The computers 31, 32, . . . 3n have user information files 51, 52, . . . 5n and terminals 61, 62, .

FIG. 2 is a data configuration diagram of the security information 10 of the security master file 4 and user information files 51, 52, . . . 5n. Security information 10
consists of a user ID 7, a password 8, and a terminal ID 9.

In this embodiment, the security information 10 is duplicated. In the security master file 4 of the host computer 2, user IDs 7 of all users of the network system, corresponding passwords 8, and terminal IDs 9 are registered in advance. In the user information files 51, 52, . . . , 5n of the terminal-side computers, a user ID 7, a corresponding password 8, and a terminal ID 9 are registered for each user. User information file 51
, 52, . . . 5n, the same user ID 7 is not registered.

FIG. 3 is a flowchart showing the processing procedure. At the start of a session, the user enters the user ID 7 and password 8 from the terminal 61 connected to the computer 31.
(Step 11). The user information file 51 in the computer 31 is searched using the user ID 7 as a key (step 12). It is determined whether the search was successful or not (step 13). If the search is successful, the password 8 in the user information file 51 obtained as a result of the search is compared with the password 8 input by the user (step 14). If the passwords 8 match, the security information 10 consisting of the user ID 7, password 8, and terminal ID 9 is transmitted to the host computer 2, and a session start request is made (step 15). A response from the host computer 2 is awaited (step 16). If the search fails or if the passwords 8 do not match, the terminal computer 31 cannot use the host computer 2.

The host computer 2 is a computer 31
, 32...3n (step 21). When the host computer 2 receives the session start request, it searches the security master file 4 using the received user ID 7 as a key (step 22). It is determined whether the search was successful or not (step 23). If the search fails, the security information is sent as invalid (step 29). In this case, the computer 31 cannot start a session because it does not have session start permission information (step 17).

If the search is successful, the password 8 obtained as a result of the search is compared with the received password 8 (step 2).
4). If the passwords 8 do not match, the security information is sent as invalid (step 29). In this case, the computer 31 cannot start a session (step 17).
). If the password 8 matches, it is determined whether the received terminal ID 9 and the terminal ID 9 obtained as a result of the search match (
Step 25). If the terminal IDs 9 match, session start permission information is transmitted as a valid user (step 26). The terminal computer 31 determines whether the received information is session start permission information (step 17). Since this is session start permission information and the user is not an unauthorized user (step 18), the computer 31 starts the session as an authorized user.

[0013] If the user ID 7 and password 8 for another terminal computer are registered in the user information file 51, and the password 8 matches but the terminal ID 9 does not match, first, the person managing the host computer The user is notified of the existence of an unauthorized user (step 27). Next, session start permission information is transmitted with access permission for a range specified in advance for unauthorized users (step 28). The terminal computer 31 determines whether the received information is session start information (step 17). Regarding the session start permission information, since the computer 31 is an unauthorized user (step 18), the computer 31 can start a session, but the range it can access is limited to the range specified in advance for unauthorized users. in this way,
Allow unauthorized users to continue using the service and give them time to investigate.
Investigate unauthorized users. Since the unauthorized user entered the authorized user ID 7 and password 8, there is a possibility that the unauthorized user may think that he or she has authorized access.

[0014] Note that access to a pre-specified range means:
For example, the administrator of the host computer 2 may specify in advance a file that will not cause any harm even if it is viewed, and the data in that part may be referenced, or a dummy file for unauthorized users may be created, and only that file may be accessed. etc.

In this embodiment, the security information 10 is duplicated, and the terminal side computers 31, 32...3n
Also, password 8 is searched using user ID 7 as a key, and it is checked whether or not there is a match. Further, the terminal ID9 added by the terminal side computers 31, 32, . . . 3n does not correspond to each terminal side computer 31, 32, . . . 3n, but corresponds to each user ID 7. Also, terminal I
D9 remains unchanged.

However, it is not necessary to check the input user ID 7 and password 8 on the terminal side computers 31, 32, . . . , 3n. Alternatively, the terminal ID 9 may be associated with each terminal side computer 31, 32, . . . 3n, and the terminal ID 9 possessed by each terminal side computer 31, 32, . . In addition, the terminal side computers 31, 32,...3n
The terminal ID 9 added by may be made variable.

Furthermore, in this embodiment, the terminal side computer 3
1, 32, . . . 3n and a host computer 2. However, as in a distributed database, every computer may act as both a host and a terminal. In that case, each computer may have a file in which the user ID 7 etc. that can access the computer is registered. If there is an unauthorized user, the person managing the accessed computer is notified of the existence of the unauthorized user.

Furthermore, in this embodiment, the input user I
D7, password 8, terminal side computers 31, 32,
...Terminal ID9 with 3n added has not been processed. In other words, the user ID 7 and password 8 sent from the terminal side
, the terminal ID 9, the user ID 7 and the password 8 possessed by the host computer 2, and the terminal ID 9 are the same. However, the host computer 2 may process the received security information 10 according to certain rules registered in advance, and compare the processed result with the security information 10 possessed by the host computer 2. Alternatively, the terminal-side computers 31, 32, . . . 3n may process the entered user ID 7 and password 8 and send them.

According to this embodiment, when an attempt is made to start a session by checking the user ID 7 and password 8 for another terminal side computer from the terminal 62 connected to the computer 32 which is a regular terminal, the computer 32 A user information file 52 contains user ID 7 and password 8.
is not registered, an error occurs when searching the user information file 52, which has the effect of preventing password theft between users.

[0020]

Effects of the Invention According to the present invention, even if the security information input by the user matches, but the security information added by the input computer does not match, the unauthorized user can be protected from a pre-specified range. allow access,
Continue the use, notify the receiving party of the unauthorized user,
By conducting a survey of unauthorized users, it is possible to easily discover unauthorized users.

[Brief explanation of the drawing]

FIG. 1 is a configuration diagram of a network system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a data format of security information in a security master file and a user information file.

FIG. 3 is a flowchart showing a processing procedure.

[Explanation of symbols]

1...Network, 2...Host computer, 31,3
2-3n... Computer, 4... Security master file, 51, 52-5n... User information file, 61,
62-6n...Terminal, 7...User ID, 8...Password,
9...Terminal ID, 10...Security information.

Claims (1)

[Claims] Claim 1: A computer system comprising a first computer having first security information and a second computer having second security information,
The second computer adds the second security information held by the second computer to the third security information input to the second computer and sends the third security information to the first computer. The first computer compares the received second and third security information with the first security information possessed by the first computer, and although the third security information matches, the second security information A security check method characterized by permitting access within a pre-specified range if security information does not match.