JPH0756795A - Center function-centralized type access controlling method - Google Patents

Abstract

PURPOSE:To use an inexpensive and widely general terminal equipment and to protect the data extremetely high in confidentiality or operation security by permitting a certain user to execute specific operation only at the time of accessing the specific operation from a previously registered specific terminal equipment. CONSTITUTION:When a terminal 12 is connected to a server 11 in a personal computer network, a terminal ID file is automatically transferred from the terminal 12 to the server 11. The server 11 checks whether the sent terminal 12 is usable operation or not in accordance with the contents of an access control table 18. After rewriting the contents of a terminal ID file 20 by a specific cipher system based upon date information, the ID file is transferred from the server 11 to the terminal 12 at the end of operation, so that preceding access information and the ciphered terminal ID become succeeding terminal ID.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION The present invention relates to a personal computer.
In a network system that uses data as terminals, in order to protect the security of data and business, a centralized access control center function that enables connection only when accessing from a terminal authorized in advance Regarding the method.

[0002]

2. Description of the Related Art Conventionally, a mail box or a database
Used by a personal computer network system that uses a host computer or workstation that has a computer as a host and a personal computer that has only a file transfer function and a basic message transmission / reception function as a terminal device. Has been done. In such a personal computer network system, when a user tries to use this network, the other party is authenticated for security protection.
As a conventional method of authenticating the other party, it is widely practiced to do so by inputting a user ID and a password. In that case, as a method for realizing confidentiality so that the terminal user does not disclose the security code to the manager on the center side, for example, Japanese Patent Application Laid-Open No. 61-212
There is a method described in Japanese Patent Publication No. 748. Also, IC card
An example of the encryption key setting method for a drive device is the method described in Japanese Patent Laid-Open No. 62-75769.
Further, as a method having an encryption algorithm on the terminal device side, for example, there is a method described in Japanese Patent Application Laid-Open No. 2-203377.

[0003]

However, in the above conventional technique, it is necessary to mount an algorithm for encryption and decryption on the terminal device side, so that the type of the terminal device is limited. However, there is a problem that it becomes expensive. Further, it is impossible for the center side to centrally manage the access control such that the access is permitted only when the user accesses from a predetermined terminal device. Therefore, the highly confidential data
In a center having a database having data, an access control in which a user and a terminal are connected on the center side
Could not do le. An object of the present invention is to solve such conventional problems, to use a cheap and wide-purpose terminal, and to centralize a central function that can protect extremely confidential data or business security. Type access control method.

[0004]

In order to achieve the above-mentioned object, the center function centralized access control method of the present invention is an individual business data that can be used only by authorized users.
In a personal computer network consisting of a server (11) having a server (16) installed and a plurality of terminals (12) connected to the server (11) through a public line (10),
The server (11) is provided with a terminal ID file for permitting access to the individual business database (16) and an access control table (18) in which the individual business is registered, and the terminal (12) is provided. ) To individual business data of server (11)
When accessing the table (16), the terminal (1
After connecting from 2) to the server (11) via the communication line (10), the user ID entered from the terminal at the server (11) and the user check at the password (19). If the check result is correct, then from terminal (12) to terminal I
By automatically transferring the D file (20) to the server (11), the server (11) refers to the access control table (18) and the terminal ID file (20).
If the check result is correct, the menu (15) of the individual work permitted to the terminal (12) is transferred to access the individual work database (16) from the terminal (12). Then, when the work is completed, the terminal (12) transfers the terminal ID file to the server (11), and the server (11) encrypts the terminal ID file to access the access control table. After rewriting the contents of (18), the rewritten terminal ID file is transferred to the terminal (12), so that the rewritten terminal ID file is used at the next access at the terminal (12). There is.

[0005]

According to the present invention, in an open personal computer network system using a personal computer and general-purpose communication software, access control including checking of terminals used is performed. In this case, a certain user is permitted to use a specific job only when he / she accesses from a specific terminal device registered in advance. This check controls the business that can be used according to the contents of the access control table of the server. The three features of the present invention are as follows. (B) Mandatory access control: A unique ID of the terminal by automatically transferring the terminal ID file from the PC to the server after connecting from the terminal to the server via the PC network Check. Then, the executable work is limited based on the checked contents. (B) Use the procedure concealment type encryption method: The content of the terminal ID file is encrypted by the proprietary encryption method, and the content of the terminal ID file is based on the date and time information for each access. Rewrite. (C) Confirming the other party by confirming the possession property ... Having the ID file transferred from the server at the end of the work is the key for the next access. As a result, even when data having extremely high confidentiality is communicated, the center side can perform access control by linking the user and the terminal, and the terminal I
Since the D file can be sequentially updated and the other party can be strictly authenticated by the method of interlocking with the next access, the security of data and business can be effectively protected.

[0006]

Embodiments of the present invention will now be described in detail with reference to the drawings. FIG. 1 is an explanatory diagram of a center function centralized access control method according to an embodiment of the present invention. Figure 1
The equipment on the center side of the personal computer network system is located on the left side, and the equipment on the terminal side is on the right side. On the center side, a server 11 which is a host computer and a plurality of external storage devices 13-18 connected thereto are installed. On the terminal side, a personal computer 12 connected to the center 11 via the public line 10, a keyboard 19 connected to the personal computer 12,
The terminal ID file 20 is arranged. Server 11
In the external storage device connected to, a file 13 storing a general business menu, a file 15 storing an individual business menu, a file 14 storing a database of general business, a database of individual business -File 1 that stores the file
6, a file 17 storing a user management file, and a file 1 storing an access control table
There is 8. The general business menu is a menu that controls the business database that can be used by anyone connected to the personal computer network, and the individual business menu can be used only by authorized users. This is a menu for controlling various individual work database. First, when the terminal 11 is connected to the server 11 of the personal computer network, the terminal ID file is automatically transferred from the terminal 12 to the server 11.
Then, according to the contents of the access control table 18, it is checked whether the sent terminal 12 can be used by the user. Next, change the contents of the terminal ID file to
After rewriting based on the date and time information by a unique encryption method, at the end of the business, the server 11 changes the terminal 1
By transferring the ID file to 2, the encrypted access information and terminal ID of the previous time becomes the next terminal ID.

FIG. 2 shows the access controller in FIG.
It is a format diagram of the table. As shown in FIG. 2, a user ID, a terminal ID, a usable individual job, and the last use date and time are described in this table. When the user wants to protect the security of the owned data and the business, the user performs the registration procedure on the server 11 and describes all in this table. FIG. 3 is a format diagram of the terminal ID file in FIG. As shown in FIG. 3, the terminal ID file stored in each terminal and the terminal ID file registered in the access control table of the server are encrypted based on the last use date information. is there. It is updated each time it is used. Each time the terminal receives the terminal ID file transferred from the server each time the use ends, the terminal ID file for the next time is encrypted by encrypting the previous access information and this terminal ID file. To do. Similarly, on the server 11 side, the contents of the table are updated by encrypting the terminal ID file on the access control table based on the last use date information.

FIG. 4 and FIG. 5 are operation flowcharts of a center function centralized type access control method showing an embodiment of the present invention. First, when it is desired to access the individual business menu 15 or the individual business database 16 of the server 11 on the terminal side, the user ID and password are input from the keyboard 19 ( Step 101). When connected to the server 11 via the public line 10, the server 11
Then, the user check is performed by referring to the user management file 17 (step 102), and it is determined whether or not the user check is OK (step 103).
If the check result is NG, the access is stopped. In the case of OK, the fact that it is OK is returned to the terminal side. Next, the terminal ID file is automatically transferred from the terminal to the server 11 (step 104). In the server 11, the terminal ID is decrypted by referring to the access control table 18 (step 105),
The terminal ID is checked (step 106). If the check result is not correct (step 107), individual work cannot be permitted, so the display of the general work menu is transferred to the terminal side (step 108), and the general work is executed on the terminal side (step). 109).

On the other hand, if the terminal ID is correct (step 1
07), the display of the general work menu and the individual work menu permitted for the terminal is transferred to the terminal side (step 110), and the terminal is made to execute the individual work (step 111). The terminal accesses the server 11 to execute the individual business program (step 112), and accesses the individual business menu 15 and the individual business database 16. When the individual business program ends, the terminal side is notified of the end of the business. On the terminal side, after confirming the end of the work (step 113), the terminal ID used in the work is transferred to the server 11. The server 11 encrypts the terminal ID (step 114),
The contents of the access control table 18 are rewritten. Then, the rewritten terminal ID file is transferred to the terminal (step 115). When the terminal ID file is received on the terminal side, it is held in the file as the terminal ID file for the next time (step 116).

As described above, the feature of the present invention is that (a) the forced access control method is used, that is, after connecting to the server of the personal computer network, the terminal ID file is transferred from the personal computer to the server. By automatically transferring, the server refers to the access control table and the terminal I
The D file is checked, and executable work is restricted based on the checked contents. (B) The procedure concealment type encryption method is adopted, that is, the content of the terminal ID file is encrypted by an originally developed encryption method, and the terminal ID file is based on date and time information for each access. Can be rewritten. (C) Using the other party confirmation method by confirming the property, that is, having the terminal ID file transferred from the server at the end of the work,
It will be the key for the next access. Due to these features, it becomes possible to provide an access control that permits the use of a specific job only when the user accesses from a specific terminal.

[0011]

As described above, according to the present invention,
The central function centralized access control method permits the use of a specific business only when the user accesses from a specific terminal, so that an inexpensive and widely used terminal is used and confidentiality is maintained. There is an effect that extremely high data or business security can be protected.

[Brief description of drawings]

FIG. 1 is an overall schematic diagram of a personal computer network showing an embodiment of the present invention.

FIG. 2 is a format diagram of an access control table shown in FIG.

3 is a format diagram of a terminal ID file in FIG.

FIG. 4 is an operation flowchart of a center function centralized access control method according to an embodiment of the present invention.

5 is a remaining portion of the operation flow chart of FIG.

[Explanation of symbols]

10 Public Line 11 Server (Host Computer) 12 Personal Computer 13 General Business Menu 14 General Business Database 15 Individual Business Menu 16 Individual Business Database 17 User Management file 18 Access control table 19 Keyboard for inputting user ID and password
Do 20 terminal ID file

Claims (1)

[Claims] 1. A personal computer network comprising a server provided with an individual business database that can be used only by authorized users, and a plurality of terminals connected to the server via a public line. In the network, the server is provided with a terminal ID file for permitting access to the individual business database and an access control table in which the individual business is registered. In the case of accessing the individual business database of the above, after connecting to the server from the terminal via a communication line, the user ID and password input from the terminal at the server are accessed. User check is performed, and if the check result is correct, the terminal ID file is automatically transferred from the terminal to the server.
Server checks the terminal ID file by referring to the access control table, and if the check result is correct, the menu of the individual business permitted to the terminal is transferred to the individual business from the terminal. When the database is accessed and the work is completed, the server can access the server.
When the terminal ID file is transferred to the server, the server encrypts the terminal ID file, rewrites the contents of the access control table, and then transfers the rewritten terminal ID file to the terminal. By doing so, the terminal function centralized access control method is characterized in that the rewritten terminal ID file is used at the next time of access.