JPH0973433A - Data processing system and its user recognizing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely avoid the state wherein the collection error generation timing of each piece of user information is perceived from outside by delaying decision end timing and then making a decision processing end time constant irrelevantly to a user information decision processing result when it is decided whether or not a data access request from each user is property. SOLUTION: An external storage device 208 stores plural pieces of user recognition information for deciding respective data access requesters by the users. A main storage device 206 stores a wait time set in a setting means. According to the decision result of a CPU 205 which decides by collation whether each piece of user recognition information stored in the external storage device 208 matches each piece of user information from one of data processors through a path 209, the decision end timing is delayed by the wait time stored in the main storage device 206. Consequently, the decision processing end time can be made constant irrelevantly to the user information decision processing result.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data processing system and a user of the data processing system for controlling a connection request from an information processing device such as a computer accessed through a predetermined communication medium to perform various data processing. It relates to a recognition method.

[0002]

2. Description of the Related Art With the recent improvement in telecommunication technology and the increasing need for information and communication, the development of computer network such as LAN and WAN has been remarkable.
At the same time, there is a demand for improvement of so-called computer security technology that prevents unauthorized use of the computer network itself and various computers connected to the computer network.

Currently, when using various computers connected to a computer network from a terminal device directly connected to the computer network or a computer network, the user's individual user ID character string is input, and then the user password character string. Is a general process for confirming whether the user ID and the user password input by a predetermined user recognition processing procedure are correct ones registered in the computer.

[0004]

However, in the user recognition method in the network system configured as described above, there are cases where the user name is not registered in the user registration list and cases where the user name is registered in the user registration list. However, the response time to the user is different when the result of the subsequent matching process of the user password is determined to be incompatible with the password.

For example, in the case where the user name is not registered in the user register, or when the user name is registered in the user register and it is determined that the password is incompatible with the subsequent user password verification processing result, the latter user The response time to the user was different because the processing time for the password verification process was longer.

As a result, another user understands whether the user ID was wrong on the user side or the user ID was correct but the user password was wrong, and a so-called hacker who attempts to illegally use the computer. There has been a problem that it gives a clue to an intruder called an illegal system intruder.

The present invention has been made to solve the above problems, and an object of the first to third inventions of the present invention is to provide a data access request from each user to the data processing device side. When determining whether a user is a valid user based on a plurality of user information, by delaying the determination end timing, the determination processing end time is kept constant regardless of the user information determination processing result, and each (EN) It is possible to provide a highly secure data processing system and a user recognition method of the data processing system, which can surely avoid a situation in which a collation error occurrence timing of user information is detected.

[0008]

According to a first aspect of the present invention, in a data processing system in which at least one terminal device can mutually communicate with a data processing device via a predetermined communication medium, each data Firstly, a plurality of user recognition information for discriminating an access requester is stored for each user.
The storage means and the user recognition information stored in the first storage means and the user information received from any of the data processing devices via the predetermined communication medium are collated to determine whether or not they match. Determination means, setting means for setting a standby time for delaying the determination end timing by the determination means, second storage means for storing the standby time set by the setting means, and a determination result of the determination means And a delay unit that delays the determination end timing by the waiting time on the data processing device side.

According to a second aspect of the present invention, the setting means detects the load state of the data processing device before starting communication, and changes and sets the standby time stored in the second storage means. It is possible.

A third invention according to the present invention is at least 1
In a user recognition method of a data processing system in which one or more terminal devices can mutually communicate with a data processing device via a predetermined communication medium, a reading step of reading a set waiting time from a storage medium and each stored user A determination step of determining whether or not the recognition information and each piece of user information received from any of the data processing devices via the predetermined communication medium, and a determination end timing based on the determination result, the waiting time. And a delay step of delaying by a minute.

[0011]

According to the first aspect of the present invention, whether each user recognition information stored in the first storage means and each user information received from any data processing device via the predetermined communication medium match. Depending on the result of the user information determination processing, the delay means delays the determination end timing by the setting means based on the determination result of the determination means, and delays the standby time stored in the second storage means. Regardless, it is possible to make the determination processing end time constant.

In the second invention, the setting means is
The load state of the data processing device is detected before communication is started, and the standby time stored in the second storage unit can be changed and set, and the load of the data processing device changes and the determination processing time changes. However, it is possible to always keep the determination processing end time constant regardless of the user information determination processing result.

In the third invention, the set waiting time is read from the storage medium, the stored user recognition information and the user information received from any of the data processing devices via the predetermined communication medium are stored. Are compared, and the determination end timing is delayed based on the determination result by the read waiting time, and the determination processing end time is made constant regardless of the user information determination processing result. Allows automation.

[0014]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram for explaining the configuration of a data processing system showing an embodiment of the present invention.

In FIG. 1, reference numeral 205 denotes a CPU for controlling the entire apparatus, which is a main storage device (CS: Central Storage).
) 206, the operation of the apparatus is controlled in accordance with a system control program including a procedure corresponding to the user approval method of this embodiment.

The main storage device 206 is an external storage control device (A
An external storage device (ASU: Auxiliary Storage Unit) 20 via an SC (Auxiliary Storage Controller) 207.
It is also a memory area for storing and executing the application program loaded from 8. In addition to the system control program including the user recognition method of the present embodiment,
Various application programs such as application programs exist in the area.

The system control program and various application programs on the main storage device 206 are operated by instructions from the following two devices.

One is a display device (SCOPE) 201, a keyboard device (KBD) 202, and a console control device (TC).
U: Terminal Control Unit) 203 is an operator console.

The other is an instruction from an external computer system connected via a computer network such as a LAN or WAN, which is a network connection mechanism (N
It is taken into this computer system through an IC (Network Interface Controller) 204. 209
The system bus is a path through which data and program instructions are transferred among the console control device 203, the CPU 205, the main storage device 206, and the external storage control device 207. In this embodiment, the above 20
1 to 203 constitute a terminal device, and a data processing device (the above 204 to 2
(Comprising No. 08) and a data processing system capable of communicating with each other.

Correspondence between this embodiment and each means of the first and second inventions and their operation will be described below with reference to FIG.

The first invention discriminates each data access requester in a data processing system in which at least one or more terminal devices can mutually communicate with a data processing device via a predetermined communication medium (route 209). Via a first storage means (external storage device 208) for storing a plurality of user recognition information for each user, and each user recognition information stored in the first storage means and the predetermined communication medium. Judgment means (CPU2) for judging whether or not the user information received from any of the data processing devices matches.
05), setting means for setting the waiting time for delaying the judgment end timing by the judging means (set by the setting processing stored in the main storage device 206 by the CPU 205), and the waiting time set by the setting means. A second storage unit (main storage device 206) for storing and a delay unit (CPU 205 stores a delay process stored in the main storage device 206 for delaying the determination end timing by the previous standby time based on the determination result of the determination unit. Delay) is provided on the data processing device side to determine whether each user recognition information stored in the external storage device 208 and each user information received from any one of the data processing devices via the route 209 are coincident with each other. Based on the determination result of the CPU 205 that performs the collation determination, the determination end timing is the standby time stored in the main storage device 206. Cast so makes it possible to constant determination processing end time regardless of the user information determination processing results.

A second invention is the setting means (CPU 20).
5) detects the load state of the data processing device before communication is started, and the second storage means (main storage device 20).
The standby time stored in 6) can be changed and set, and the determination processing end time is always constant regardless of the user information determination processing result even if the load of the data processing device changes and the determination processing time changes. It is possible to

Next, the user authentication method of the data processing system according to the present invention will be described with reference to the flowchart shown in FIG.

FIG. 2 is a flow chart showing an embodiment of the user recognition method of the data processing system according to the present invention. Note that (1) to (6) indicate each step. Also,
The procedure corresponding to each step is stored in the system control program of the main storage device 206, and includes the display device (SCOPE) 201 and the keyboard device (KB) shown in FIG.
D) 202, console control unit (TCU: Terminal Contr)
ol Unit) 203 and the network connection mechanism 204 are used to perform authentication processing for a user who has requested to use the computer.

The operator console and the network connection mechanism 20 are used as input values for this processing flow.
The user's individual user ID character string and user password character string input via 4 are passed. The detailed flow of each step will be described below.

First, in step (1), as an initialization process, a return value area indicating an authentication result is initialized with an "initial value not to be authenticated" in the control program area of the main memory (CS) 206. , The area for reading the user registration information for one user entry from the user registry is initialized, and the area for reading the wait setting time value is initialized.

Next, in step (2), the wait setting time value defined in the system control parameter file on the external storage unit (ASU) 208 shown in FIG. 1 is read into the area initialized in step (1), In step (3), the user registration file on the external storage device 208 shown in FIG. 1 is searched for a user entry corresponding to the user registration information corresponding to the user ID character string input in the process flow.

Next, in step (4), it is determined whether or not the user entry corresponding to the user ID character string exists in the user registry, and if it is determined that the user entry exists, it is initialized in step (1). It is read in the read area.

The step (4) is a step of determining whether or not the user entry corresponding to the user ID character string is read out in the step (3). If it is not read in step (3), it is determined that it has been initialized in step (1).

On the other hand, when it is determined in step (4) that the user entry corresponding to the user ID character string has not been read out, in step (6), the wait function of the system control program is used to execute step ( The processing flow is temporarily suspended for the wait setting time value read in 2), and this processing flow ends after the wait setting time value has elapsed.

On the other hand, if it is determined in step (4) that the user entry corresponding to the user ID character string has been read out, in step (5) the user password character string input to this processing flow is used. Step (3)
When the password registered in the user entry read in step 3 is verified, and as a result of the verification, the user password character string is found to be a correct password,
The authentication value is set in the return value area indicating the authentication result initialized in step (1), and the process ends.

The process shown in steps (3), (4) and (6) of this process flow, and the configuration of the system control parameter file and the user registry file are used in the conventional user authentication method. The processing is the same as that described above. Further, in the present embodiment, the processes of step (2) and step (5) are added, and the area for reading the wait setting time value is added in step (1).

Correspondence between the present embodiment and each step of the third invention and its action will be described below with reference to FIG.

In the user recognition method of the data processing system, in which the third at least one terminal device can communicate with each other via the predetermined communication medium (path 209), the read standby time is read from the storage medium. Process (Fig. 2
(2)) and a determination step of determining whether or not the stored user recognition information and the user information received from any of the data processing devices via the predetermined communication medium match (FIG. 2 steps (3), (4),
(6)) and a delaying step (step (5) in FIG. 2) of delaying the determination end timing by the waiting time based on the determination result to perform the determination regardless of the user information determination processing result. It is possible to automate the processing for keeping the processing end time constant.

In this way, when it is determined that the user name is not registered in the user register, the wait time registered in advance when the user authentication method of the present invention is started is read, and the user name is registered in the user register. If it is determined that it has not been done, it is possible to delay by this wait time value.

Further, in the present embodiment, the wait setting time value is not set to a fixed setting value and is always read at the start of the user recognition processing, so that the load on the computer system using the user recognition method of the present embodiment varies. Even if the processing time required for the user password verification process changes, if the wait setting time value defined in the system control parameter file is changed correspondingly, the new value will be valid at the start of the next user recognition process. become. This makes it possible to dynamically respond to the operating status of the computer system via the network.

According to the above-described embodiment, by using the operation of this embodiment, in the conventional user authentication method, the user name is not registered in the user register and the user name is registered in the user register. If it is determined that the password does not match based on the result of the subsequent user password verification process, the response time for the user is different because the processing time of the latter user password verification process is spent, and the user side It is possible to effectively avoid a situation in which it is understood whether the user ID was wrong or the user ID was correct but the user password was wrong.

As a result, it is possible to reduce the risk that an illegal system intruder, a so-called hacker who attempts to illegally use a computer, may be given a clue of intrusion.

The present invention may be applied to a system composed of a plurality of devices or an apparatus composed of one device. Further, it goes without saying that the present invention can be applied to the case where it is achieved by supplying a program to a system or an apparatus. In this case, by reading a storage medium storing a program represented by software for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention. .

Further, by downloading and reading a program represented by software for achieving the present invention from a database on a network by a communication program, the system or apparatus can be
It is possible to enjoy the effects of the present invention.

[0042]

As described above, the first aspect of the present invention
According to the invention, the collation determination is made as to whether each user recognition information stored in the first storage means and each user information received from any data processing device via the predetermined communication medium match. Based on the determination result of the determination unit, the delay unit delays the determination end timing by the standby time set by the setting unit and stored in the second storage unit. Therefore, the determination is made regardless of the user information determination processing result. The processing end time can be constant.

According to the second invention, the setting means detects the load state of the data processing device before the start of communication,
Since it is possible to change and set the standby time stored in the second storage means, even if the load of the data processing device fluctuates and the judgment processing time fluctuates, the user information judgment processing result is always obtained. The determination processing end time can be made constant.

According to the third invention, the set waiting time is read from the storage medium, and the stored user identification information and the user information received from any of the data processing devices via the predetermined communication medium. Is compared with each other, and the determination end timing is delayed based on the determination result by the read waiting time. Therefore, the determination processing end time is made constant regardless of the user information determination processing result. The process can be automated.

Therefore, there is an effect that it is possible to surely avoid a situation in which a collation error occurrence timing of each user information is perceived from the outside.

[Brief description of drawings]

FIG. 1 is a block diagram illustrating a configuration of a data processing system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing an embodiment of a user recognition method of the data processing system according to the present invention.

[Explanation of symbols]

 201 display device 202 keyboard device 203 console control device 204 network connection unit 205 central processing unit (CPU) 206 main storage device 207 external storage control device 208 external storage device 209 system bus (path)

Front page continuation (72) Inventor Hitoshi Ozaka 3-30-2 Shimomaruko, Ota-ku, Tokyo Canon Inc. (72) Inventor Takeyuki Nagashima 3-30-2 Shimomaruko, Ota-ku, Tokyo Canon Inc. (72) Inventor Hiroki Oyano 3-30-2 Shimomaruko, Ota-ku, Tokyo Canon Inc.

Claims (3)

[Claims] 1. In a data processing system in which at least one or more terminal devices can mutually communicate with a data processing device via a predetermined communication medium, a plurality of user identification information for discriminating each data access requester is provided. First storage means for each user, each user recognition information stored in the first storage means, and each user information received from any data processing device via the predetermined communication medium Determination means for collating and determining whether they match, setting means for setting a standby time for delaying the determination end timing by the determination means, and second storage means for storing the standby time set by the setting means, A delay unit that delays the determination end timing by the standby time based on the determination result of the determination unit is provided on the data processing device side. Data processing system. 2. The setting means is capable of detecting a load state of the data processing device before communication is started and changing and setting the standby time stored in the second storage means. The data processing system according to claim 1. 3. A user recognizing method of a data processing system, wherein at least one or more terminal devices can mutually communicate with a data processing device via a predetermined communication medium, and a reading step of reading a set waiting time from a storage medium. And a determination step of determining whether or not the stored user recognition information and the user information received from any of the data processing devices via the predetermined communication medium match, and based on the determination result. And a delay step of delaying the determination end timing by the waiting time, the user recognizing method of the data processing system.