JPH05327691A - Illegal user access prevention system - Google Patents

Abstract

PURPOSE:To enhance the safety of prevention of illegal user access and to control the service in details at every illegal user. CONSTITUTION:An illegal user count section 3-2 counts the frequency of illegal access at every illegal user and it is stored in an illegal database 3-5. When an illegal user reporting section 3-1 reports it to a authentication machine 2 when the frequency of illegal access is a prescribed frequency or over for a prescribed period of time and rejects a service request by the illegal user from a service request machine 4. Upon the receipt of information of the illegal user from the service supply machine 3, the authentication machine 2 converts the service permitting information at every user stored in the user authentication database on a prescribed rule of the service permitting information conversion table 2-3 and revises the storage to manage the illegal user.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an unauthorized user access prevention system for a network system composed of a plurality of computer systems connected via an arbitrary communication medium.

[0002]

2. Description of the Related Art Conventionally, in an unauthorized user access prevention system in a distributed environment in which a plurality of computer systems are arbitrarily connected via a communication medium, an authentication server, which is a specific computer, collectively manages user information and a user name. User authentication is performed using the password and password, and this authentication server issues the authenticated certificate that permits the use of various services in the distributed environment, and the procedure for starting the use of the service requested by the user is performed. The service is provided to the user's service request, the service request is rejected to the unauthorized user's request, the number of unauthorized access is counted, and the number of times is set for a predetermined time set by the entire system. If the number of times exceeds the specified number of times, the user cannot use the entire system. All by intention had been an unauthorized user.

[0003]

As described above, conventionally, in an unauthorized user access prevention system on a network in which a plurality of computer systems are connected via arbitrary communication media, by counting the number of unauthorized access, If the number of times exceeds the predetermined number within the preset time, it unconditionally disables the use of the entire computer system, so you can use the authenticated certificate that has expired without knowing it or authenticate it to others. There is a problem in that it is regarded as an unauthorized user by replacing the authentication certificate, and as a result, not only the requested service but also other services that can be used in the entire computer system cannot be used.

Therefore, an object of the present invention is to provide an unauthorized user access prevention system which eliminates such problems, enhances the security of unauthorized user access prevention, and can control fine services. .

[0005]

The present invention has a user authentication system for collectively managing user information and service permission information, and is illegal on a network in which a plurality of computer systems are connected via arbitrary communication media. In the unauthorized user access prevention system for preventing the use of the service by the user access, the user authentication system converts the service permission information into a predetermined rule according to an unauthorized user access report from the plurality of computer systems. And a permission information conversion table.

[0006]

The present invention has a user authentication system for collectively managing user information and service permission information, and uses services by unauthorized user access on a network in which a plurality of computer systems are connected via arbitrary communication media. In the unauthorized user access prevention system for preventing the above, the user authentication system, when there is an unauthorized user access report from the plurality of computer systems, allows the classified service permission information included in the user authentication system to permit the service. The conversion is performed according to a predetermined rule of the information conversion table.

[0007]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a configuration block diagram of an unauthorized user access prevention system which is an embodiment of the present invention. Figure 1
In the network, a plurality of computer systems 2 to 4 are connected to the communication medium 1 in the network. The computer system 2 is an authentication machine that collectively manages user information, and a database management unit 2- that manages a user authentication database 2-5 such as personal information and service permission information.
2. A service permission information conversion table 2-3 for converting the current service permission information stored in the user authentication database 2-5 into new service permission information, and a user management unit 2-1 for managing service use by an unauthorized user. It is configured. The computer systems 3 to 5 are computer systems generally used by users, and service request units 3-4, 4-4, 5- which request various services.
4. Service acceptance section 3-3,4-which accepts services
3, 5-3, an unauthorized user counting unit 3-2, 4-2, 5-2 which counts the number of unauthorized user access when accessed by an unauthorized user, and access by an unauthorized user, within a predetermined time. An unauthorized user reporting unit 3-1, 4-1, 5-1 for reporting unauthorized user information to the authentication machine 2 when the unauthorized access is performed a predetermined number of times or more. Further, when the computer system operates as a service supply machine, it has an unauthorized database 3-5 which stores information on service requests from unauthorized users.

Next, an outline of a service request procedure when a user uses services of a plurality of computer systems will be described. The user is the service requesting machine 4
The service of the service supply machine 3 is used.

First, when a user inputs a user name from the service requesting machine 4, the service requesting machine 4 requests the authentication machine 2 for an initial ticket which is an identity guarantee ticket with an expiration date. On the other hand, the authentication machine 2
Judges whether the authentication is permitted or not, and sends the initial ticket to the service requesting machine 4. Next, the user inputs the password and the service name to be used in the service requesting machine 4. The service requesting machine 4 requests the authentication machine 2 for a service ticket for authenticating the service.
On the other hand, the authentication machine 2 authenticates the service to be used and sends a service ticket to the service requesting machine 4.

Next, the service requesting machine 4 sends the service ticket sent from the authentication machine 2 to the service supplying machine 3. If it is determined that the service ticket received by the service supply machine 3 is valid, the service is started. On the other hand, in the case of a false service ticket, the service supply machine 3 records it in the fraud database 3-5, reports the fraudulent user name to the authentication machine 2 under a predetermined condition, and sends it to the service requesting machine 4 To refuse the service.

FIG. 2 is an operation flowchart for detecting an unauthorized user in the service supply machine and reporting to the authentication machine. First, the service supply machine 3 accepts a service from the service requesting machine 4 (step 201), decodes the received service ticket (step 202), and determines whether the service ticket is a legitimate service ticket (step 203). If it is determined that the ticket is an authorized service ticket, the service is started (step 20).
4). However, there is a case where an unauthorized user in the service requesting machine 4 requests the service by encrypting an unauthorized ticket created by himself to the service accepting unit 3-3 of the service supplying machine 3 and sending it to the service supplying machine. .. In such a case, if the service ticket is invalid, the service request time for each user name is recorded in the unauthorized database 3-5 (step 205). further,
The number of unauthorized accesses of unauthorized users recorded in the unauthorized user database 3-5 is checked (step 206).
Here, in the fraudulent user database 3-5, it is recorded whether or not the preset number of times has been exceeded within a preset fixed time. Next, it is judged whether or not this preset fixed time has elapsed (step 207), and if it exceeds the fixed time, the record of this unauthorized user is deleted (step 208), and the fixed time is set. If not exceeded, leave it as it is. Further, it is judged whether or not the unauthorized access is the specified number of times or more (step 209),
If it is the specified number of times or more, the user name is encrypted to the authentication machine 2 and the unauthorized user reporting unit 3-1 reports it (step 210). Then, finally, the refusal of the service to the access by the unauthorized user is transmitted to the service requesting machine 4 (step 211).

FIG. 3 is a flowchart of service authorization information conversion in the authentication machine. First, the authentication machine 2
Is waiting for a report (step 301). Here, when the encrypted illegal user name and service name are received from the service supply machine 3, the encrypted illegal user name and service name are decrypted (step 302), and the illegal user name and service name are retrieved from the user authentication database 2-5 (step 30).
3). Further, the service permission information for the unauthorized user in the retrieved illegally accessed service name is converted according to the conversion rule, and the service permission information in the user authentication database is updated (step 304).

FIG. 4 is a diagram showing the structure of the user authentication database. As shown in FIG. 4, the user authentication database 2-5 is stored for each service name, and the service permission information and the user name are stored as a pair for each service name.

FIG. 5 is a diagram showing the rules of the service permission information conversion table. FIG. 5A shows the relationship between the service permission information before conversion and the service permission information after conversion.

Here, each service permission information has the following meaning. For convenience, the characters in the circle
Explain using only symbols. That is, “+”: this service can be used.

"Peel": Originally it was "+", but it is currently unusable due to the unauthorized access prevention function.

"-": This service is unavailable.

"Bad": Originally "-", but now unusable due to the unauthorized access prevention function.

"Fail": Originally not included in the service information, but is currently unusable due to the unauthorized access prevention function.

FIG. 5B is a diagram further explaining the service permission information. In FIG. 5B, there are three cases of unauthorized access status. That is, in the initial state of the upper stage, the service use of the entire system is permitted and the use of the requested service is permitted, and the service use of the entire system of the middle stage is permitted, but the requested service is permitted. There is a case where only the use of the service is not permitted, and a case where the use of the service of the entire system in the lower stage and the use of the requested service are not permitted. The initial state at the top is "+" in the service permission information.
The initial state in the middle row corresponds to "-" in the service permission information. Note that the lower part corresponds to the case where the computer system is physically intervened, not from the service requesting machine. Therefore, these three initial states are converted into three pieces of service permission information of "stripped", "bad", and "impossible". Of course, if no new unauthorized access is reported, the initial state remains unchanged.

By setting the handling in advance in the service permission information classified in this way, fine-grained user authentication can be performed.

[0023]

As described above, the present invention has a user authentication system that collectively manages user information and service permission information, and on a network in which a plurality of computer systems are connected via arbitrary communication media. In the unauthorized user access prevention system for preventing the use of the service by the unauthorized user access, the user authentication system is classified by the user authentication system when there is an unauthorized user access report from the plurality of computer systems. Since the service permission information is converted according to a predetermined rule of the service permission information conversion table, it is possible to reduce the number of unauthorized access of the plurality of computer systems on the network and also to prevent unauthorized users. Improves the safety of access prevention and It has the advantage of being able to control the services.

In particular, since the service permission information converted by the service permission information table is classified into a plurality of types, it is possible to individually discriminate whether the user is a true malicious user intentionally or an inadvertent malicious user. , And has the advantage of having the flexibility to remedy an inadvertent unauthorized user in stages.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of an unauthorized user access prevention system according to an embodiment of the present invention.

FIG. 2 is an operation flowchart of fraudulent user detection in a service supply machine and reporting to an authentication machine.

FIG. 3 is a flowchart of service permission information conversion in the authentication machine.

FIG. 4 is a diagram showing a configuration of a user authentication database.

FIG. 5 is a diagram showing rules of a service permission information conversion table.

[Explanation of symbols]

 1 Communication Medium 2 Authentication Machine 2-1 User Management Unit 2-2 Database Management Unit 2-3 Service Information Conversion Table 2-5 User Authentication Database 3 Service Supply Machine 3-1, 4-1 and 5-1 Unauthorized User Report Unit 3-2, 4-2, 5-2 Unauthorized user count part 3-3, 4-3, 5-3 Service acceptance part 3-4, 4-4, 5-4 Service request part 3-5 Unauthorized database 4 service Request machine 5 computer system

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁵ Identification code Internal reference number FI Technical display location G06F 1/00 370 E 7165-5B G09C 1/00 9194-5L H04L 12/28

Claims (1)

[Claims] 1. A user authentication system that collectively manages user information and service permission information, and prevents the use of services by unauthorized user access on a network in which a plurality of computer systems are connected via arbitrary communication media. In the unauthorized user access prevention system, the user authentication system includes a service permission information conversion table for converting the service permission information based on a predetermined rule according to an unauthorized user access report from the plurality of computer systems. An unauthorized user access prevention system characterized by the following.