JPS59158424A - Security protecting system - Google Patents

Abstract

PURPOSE:To guarantee security of information by permitting access only to a device included in a device group permitting accessing and rewriting timewise access permission information to prevent inadequate accessing. CONSTITUTION:A device identification signal 45 is outputted from a comparator 53 and an access permission signal 54 is outputted from a comparator 53 respectively and they are ANDed at an AND circuit 55. As a result a reception permission signal 56 is fed to a reception signal control section 37. The control section 37 starts a reception permission signal 35, converts serial data from a receiver 33 into parallel data and compares the data with check data at a node processor control circuit 41 via a buffer 39. When the data is normal, a normal receiving packet is formed and fed to a perpheral device 32 and also to a transmitting device via a transmission section 36 at the same time. Further, a control circuit 58 reports a new access permission device address to a node processor 31 by a timer 57 and the control circuit 41 rewrites the stored content of an access permission evice address register 52.

Description

[Detailed description of the invention] [Field of application of the invention] The present invention relates to a security system, and particularly to a security system.

This paper relates to a security system for a network system that transmits messages using an online system.

Conventionally, this type of network 7 system, as shown in FIG. 6 and 7 are coupled to the transmission path 1 via the node processor 8, and a network system is adopted in which no dedicated bus control device is provided.

The node processor 8 stores the data received from the central processing unit @2, the terminal devices 3, 4.5, or the storage device 6.7 in the transmission buffer within the node processor 8, and uses the transmission path l. The status is checked, and if other node processors 8 are not using it, transmission is started on the transmission path 1 after converting the transmission data in the transmission buffer into serial data.

The transmitted message includes a source device address and a destination address, and the node processor 8 that has detected the destination address of its own station stores this transmitted message in its own reception buffer. A method is adopted in which, after all messages have been successfully received, message reception is reported to the address of the sending device.

Next, using Fig. 2 and Fig. 3, Node Zorocessor 8
Explain the operation.

FIG. 2 shows a network system in which all devices 1 to 7 are connected by one transmission path 1 through node processors, and when each node processor 8 receives a transmission message from a device, it transmits the message in a contention manner. This is an example of the packet format used. The packet is composed of a flag (orientation) 20, a destination device address 2, a source device address 22, data 23, and check data 24.

FIG. 3 is a block diagram showing the circuit configuration of the node processor. In the figure, 30 is a transmission path, 31 is a node processor, and 32 is a peripheral device such as a terminal device or a storage device.

33 is a receiver that receives a transmission signal from the transmission path 30; 34 is a transmitter that sends a transmission signal to the transmission path 30; 35 is a receiver that converts the received clear data into parallel data; 36 is a receiver that converts the parallel data into 7 real data. 37 is a reception control section that controls the 7 real data reception section 35; 38 is a transmission control section that controls the clear data transmission section 36; 39
40 is a receiving buffer that stores parallel data converted by the clear data receiving section 35; 40 is a transmitting buffer that stores parallel data sent to the serial data transmitting section 36; 41 is an overall control of the node processor 31; 42 is a destination address register that stores the destination device address 21 of the packet shown in FIG. 2, and 44 is a device that stores the address of the device 32. Address register 43 is the destination address register 4
This is a comparator that compares the contents stored in No. 2 and the contents stored in the device address register.

Next, the operation of the node processor 31 having the above circuit configuration will be explained below.

When the reception control unit 37 detects a packet flag 20 as shown in FIG. 2 on the transmission path 30, it activates the serial data reception unit 35. This serial data receiving section 3
5 converts the clear data received by the receiver 33 into parallel data, and stores the destination address 21 of the packet into the destination device address register 42. A comparator 43 compares the contents stored in the destination device address register 42 and the contents stored in the device address register 44, and reports the result to the reception control section 37. If the contents stored in the destination device address register 42 and the contents stored in the device address register 44 do not match, the reception control section 37 waits for the next flag, and if they match, the clear data reception section 35 transmits the serial data. is converted into parallel data, and the transmitted packet is stored in the reception buffer 39. The node processor control circuit 41 compares the data 23 of the packet stored in the reception buffer 39 with the check data 24 of the same packet, and if the data is normal, sends the data 23 to the peripheral device 32. In addition, a packet reporting normal reception is generated in the transmission buffer 40 for the source device address 22 of the received packet, and the clear data transmission unit 36 converts it into 7 real data.
A reception report is sent to the sending device.

In the conventional method, if the destination device address 21 matches the device address, the packet is sent to the peripheral device 3.
2, all peripheral devices 32 can be accessed, and if the peripheral device is a storage device, the data 23 can be shared. However, data protection (6) is not provided for items that require confidentiality protection, such as personal data, and the problem is that information can be easily stolen, rewritten, or even destroyed. There was a point.

[Purpose of the invention]

The purpose of the present invention is to eliminate the above-mentioned conventional problems, and to prevent unauthorized access such as viewing or writing of confidential information from a device to which access is not permitted, and to completely protect the information. The purpose of the present invention is to provide an internal information protection method that guarantees the confidentiality of information by dividing access rights in time by rewriting access permission information all the time.

SUMMARY OF THE INVENTION The main point of the present invention is that all devices such as central processing units, terminal devices, and storage devices are connected by one transmission path through node processors, and each node processor receives outgoing messages from the devices*. In a network system that sends a message using the contention method when a message is received, an address storage means is provided in the node processor to store the address of the device to which access is permitted. The security system compares the source address with the address of the device to which access is permitted stored in the address storage means, and permits access only if the address of the source device is permitted to access.

Another key point of the present invention is a security system in which the devices that can be accessed can be changed over time by using a timer to change the addresses of devices that are allowed access in the node processor.

Embodiments of the Invention] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

Also in the embodiment of the present invention, the packets used between devices are 7 lags 20.2 as shown in FIG. Source device address 21
A packet consisting of a source device address 22, data 23, and check and check data 24 is used.

FIG. 4 is a block diagram showing the circuit configuration of a secure node processor that is an embodiment of the present invention. In this figure, parts given the same reference numerals as those in FIG. 3 indicate the same parts, and therefore their explanation will be omitted.

In the figure, 51 is a source device address register that stores the source device address 22, 52 is an access permission device address register that is set at the time of initial setting or when there is a rewrite request from the peripheral device 32, and 53 is the above-mentioned access permission device address register. A comparator that compares the contents stored in the source address register 51 and the contents stored in the access permission device address register 52; 54 is an access permission signal output from the comparator 53; 55 is an output signal from the comparator 43; and an AND circuit that takes the logical product of the access permission signal from the comparator 53, 56 is a reception permission signal that is the output of the AND circuit, and 57 is a timer forming the peripheral device 32, which changes the devices that can be accessed over time. 58 is a peripheral device control circuit that also constitutes the peripheral device 32.

Next, the construction of the node processor that constitutes one embodiment of the present invention will be described in detail.

When the reception control unit 37 detects the flag 20 of packet (9) on the transmission path 30, the reception control unit 37 controls the serial data reception unit 35.
Start. The serial data receiving section 35 is connected to the receiver 3
The serial data received in step 3 is converted into parallel data, and the destination address 21 of the packet is stored in the destination device address register 42, and the source device address 22 of the packet is stored in the source device address register 51.

The contents stored in the destination device address register 42 are compared with the contents stored in the device address register 44 by a comparator 43. When both match, comparator 43 device identification signal 45
Output. Further, the comparator 53 completely compares the contents stored in the source device address register 51 and the contents stored in the access permission device register 52, and when the two match, an access permission signal 54 is issued. Device identification signal 45 from comparator 43
and the access permission signal 54 from the comparator 53 are ANDed in an AND circuit 55, and a reception permission signal 56 is issued from the AND circuit 55 to the reception control section 37. Receiving the reception permission signal 56, the reception control unit 37 activates the serial data reception unit 35, converts the serial data received by the receiver 33 into parallel data, and transfers the converted parallel data to the reception buffer 39. Store.

The data 23 stored in the reception buffer 39 is compared with the check data 24 in the node processor control circuit 41 to perform a data check. If the data is normal, the node processor control circuit 41 sends the data to the peripheral device 32 and creates a packet in the transmission buffer 40 to report normal reception to the source device address 22.
The serial data transmitter 36 converts the received data into serial data and reports the reception to the transmitting device.

On the other hand, the contents stored in the source address register 51 and the contents stored in the access permission device address register 52 do not match, and the access permission signal 54 is not issued from the comparator 53.
If the reception permission signal 56 is not issued from the AND circuit 55, the reception control 37 waits for the next 7 lags.

Next, changing the contents stored in the access permission device address register 52 will be explained.

When the peripheral device 52 is powered on, it reports its own device address and access-permitted device address to the node 31. The node processor control circuit 41 stores the reported device address in the device address register 44 and the access-permitted device address in the access-permitted device address register. The same-side device control circuit 58 that has received the time report from the timer 57 reports the new access permission device address to the node processor 31 , and the node processor control circuit 41 that has received the report updates the access permission device address register 64 to store the new access permission device address. Rewrite the content.

Note that in the above embodiment, the device address register 42
, source device address register 5t, access permission device address register 52, node processor control circuit 41
It is also possible to miniaturize the system by configuring it with a system using an i-micro sensor. Also, timer 57
It is also possible to provide the access permission device register 52 in the node 31 and rewrite the contents stored in the access permission device register 52 by the node 51. Furthermore, it is also possible to provide a flag in the access permission device register 52 and change the device to which access is permitted based on the flag.

〔Effect of the invention〕

As explained above, the security system according to the present invention includes an address storage means for storing the address of a device to be granted access in a node accessor, and a means for detecting a message addressed to the node accessor and detecting the sender of the message. Comparing means for identifying a device address and comparing the source device address with the content stored in the address storage means, so as to permit access only to devices included in the device group to which access is permitted. This has the effect of guaranteeing the confidentiality of information against access from unauthorized devices.

Furthermore, since the storage address of the address storage means for storing the addresses of the devices to which access is permitted can be changed over time, there is also the effect that information can be protected over time.

(13)

[Brief explanation of the drawing]

Fig. 1 is a diagram showing a network 7 stem to which the present invention is applied, Fig. 2 is a format diagram showing an example of a packet used in the network 7 stem to which the present invention is applied, and Fig. 3 is a diagram showing a conventional FIG. 4 is a block diagram showing the circuit structure of a node processor according to an embodiment of the present invention. l, 30...Transmission path, 2...Central processing unit, 31
4.5...Terminal device, 6,7...Storage device, 8.3
1... Node Grosse yT132... Peripheral device, 33
・・・Receiver, 34...Transmission, ri, 35...
- Serial data receiving section, 36... Serial data transmitting section, 37... Reception control section, 38... Transmission control section,
39...Reception buffer, 40...Transmission buffer, 4
DESCRIPTION OF SYMBOLS 1... Node processor control circuit, 42... Destination device address register, 43... Comparator, 44...
Device address register, 45...device identification signal, 51
... Source address register, 52 ... Access permission device address register, 53 ... Comparator, 54 ...
・Access permission signal (14), 55...AND circuit, 56...Reception permission signal,
57...Timer, 58...Peripheral device control circuit. (15)

Claims (2)

[Claims] (1) Security protection of a network system in which multiple peripheral devices and one or more central processing units are coupled via one transmission path via a node processor +j, and each node processor transmits all messages in a contention manner. The method includes an address storage means for storing addresses of a group of devices to which access is permitted in a node processor, and detects a message addressed to the node processor, identifies the sender device address of the message, and stores the sender device address and the above-mentioned device address. 1. A security protection system, comprising comparison means for comparing the contents stored in the address storage means, and permitting access only to devices included in the group of devices to which access is permitted. (2) It is provided with means for changing the address of the device group that can be accessed in accordance with the storage address total time of the address storage means for storing the address of the device group that can be accessed completely, so that the device to be accessed can be changed'! i? A security protection system according to claim (1) characterized by: