RU2174928C1 - System for accessing data - Google Patents

Abstract

FIELD: computer systems. SUBSTANCE: method involves introducing new modules and links between functional nodes for building multilevel authorized data access control and recording user access to storage areas. Multilevel data access is created depending on password code entered by user. Deleting data from memory is carried out after the user finished working with data so that the next user could not read the data retained in memory after the previous user of higher access authorization level has logged out. Self-test mode is realized to check device reading data from electronic protection key unit. EFFECT: enhanced effectiveness of data protection from unauthorized access. 3 cl, 1 dwg

Description

 The invention relates to railway automation and is used in driving vehicles, in particular in the work of train dispatchers.

 In the management of rail transport during the work of train dispatchers, software and hardware and information and computing resources (computers) are widely used, which require the organization of authorized access to them by a person. Reliability of driving vehicles is directly related to this.

 There are a significant number of methods and devices for protecting information in computer systems for various purposes (including those related to driving vehicles), which are based on restricting access to information of various levels of confidentiality, the use of passwords when entering the system, blocking of individual memory blocks, application means of cryptographic protection, suppression of spurious electromagnetic radiation of computing devices and information transmission channels (copyright certificates SU 557414, 1513458, patents FR 2673477, 2690258, 2702857, applications DE 4315732, 4103173, patents US 5136712, 5339427). All these known methods and devices do not provide sufficiently effective protection of the computing complex from unauthorized access.

 The closest in technical essence is the information access system described in the application EP 0449256, containing a microcontroller, including the first memory block, in which encrypted program data is stored in reverse order, the second memory block, which stores the key to the cipher, necessary for decoding the password stored in the first memory, the central processor that controls the recording or reading of data from the first or second memory blocks, and the block, which is based on the key stored in the second memory block, re-encrypts the cipher of program data stored in the first memory block when the processor accesses the memory based on data decoding. In this known device, attempts of unauthorized access of a potential intruder to the resources of a computer system are not recorded and additional actions are not formed that impede these attempts, which, among other things, makes the protection of a computer complex from unauthorized access insufficiently effective.

 The basis of the invention is the task of creating a system of access to information stored in a computer, in which due to the introduction of new blocks, as well as new connections between functional nodes, it would be possible to introduce a multi-level check of authorized access to information, registering users' access to certain memory zones , multilevel access to information depending on the password code of users, ensuring that information is erased in the random access memory after completion of the subject’s work with and information so that the subsequent subject could not use the information in the random access memory left over from the work of the previous subject, which has a higher level of access to information, allowing self-testing of the device for removing information from an electronic key.

 The technical result, to which the invention is directed, is to increase the efficiency of the information protection system stored in the computer memory.

 This technical result is achieved due to the fact that the information access system includes an electronic key, an electronic key information retrieval device, connected by two-way communication with an information storage and processing device, and an electronic key information retrieval device includes a module for interrogating and receiving information from an electronic a key connected by two-way communication with the central processor of the electronic key information retrieval device, an electronic key simulator, and one input of an electronic simulator first key connected to the output of the CPU, and the other input-output - a survey module and receiving information from an electronic key (the link, designated as an input-output indicates two-way communication between the units). The information storage and processing device includes a storage device, a system operation unit, an input data input unit, an information input and output device, a password input and user identification unit, an access level permission control unit, a user access information registration unit, a random access memory, a cleaning unit random access memory, while the storage device contains N memory zones corresponding to N memory access levels, the output of the password input unit and ident fictitious users is associated with the first input of the access level permission control unit, the first output of which is associated with each of the N memory zones of the storage device, and the second output is associated with the user access information registration unit, the output of each of the N memory zones of the memory device is associated with the first operational input storage device, the second input-output of which is connected by two-way communication with the second input-output of the system operating unit, the third output of which is connected to the input of the cleaning unit another device, the output of which is connected to the third input of random access memory, the fourth output of the system operation unit is connected to the first input of the password input and user identification unit and to the second input of the access level permission control unit, in addition, the system operation unit is connected by a bus to the input unit data, a device for input and output of information and a unit for registering user access to information, and random access memory is connected by two-way communication with the device the input and output of information, which is connected by another way to the input data input unit, the output of which is connected to the input of the access level permission control unit, while the electronic key information retrieval device through the port controller is connected by two-way communication with the password input and user identification unit. Preferably, the module for interrogating and receiving information from an electronic key is configured to generate a probe signal and receive a probe signal modulated by an electronic key. The system operating unit of the information storage and processing device is understood to mean a processor. A testing unit connected to the system operating unit, an access level permission control unit and a user access information registration unit has been introduced into the information storage and processing device.

 The scheme of the information access system is shown in the drawing.

 The system consists of an electronic key 1, a device 2 for retrieving information from an electronic key 1, a device 3 for storing and processing information, and an information input and output device 4. The device 2 for collecting information from an electronic key 1 includes a central processor 5, a module 6 for interrogating and receiving information from an electronic key 1, a simulator 7 of an electronic key 1, and a port 8 controller.

 The device 3 for storing and processing information includes a memory device 9 with N access levels to it, a block 10 for controlling the allowed access level, a block 11 for registering user access to information, a block 12 for inputting initial data, a block 13 for entering passwords and user identification, random access memory a device 14, a cleaning unit 15 for random access memory, a system operating unit 16. The system is equipped with a device 17 for input and output of information, which is, for example, a keyboard and monitor, and / or ter. In the information storage and processing device 3, a testing unit 18 may be introduced associated with the system operation unit 16, the access level permission control unit 10, and the information access registration unit 11.

 The operation of the system is as follows.

 A device 2 for retrieving information from an electronic key 1 is connected to a device for storing and processing information 3 (computer). A readiness of the system for operation is checked. After confirming the readiness of the system for operation, the user who wants to access the information stored in the storage device 9 places the electronic key 1 above the working area of the electronic key reader 2, without touching it.

 The electronic key 1 contains information (password) recorded in the key memory. For example, an electronic key may contain a 64-bit code. The electronic key 1 may not contain a power source. In this case, when the electronic key 1 approaches the information reading device 2, the module 6 irradiates the electronic key 1 with a probing signal, while providing power to the electronic key 1. The electronic key 1 modulates the probing signal in accordance with the code stored in the electronic key 1. The polling module 6 and receiving information from the electronic key 1 receives a modulated signal, decrypts it and checks for accuracy. With the correct receipt of the electronic key code 1, the information pickup device 2 requests the information storage and processing device 3 to receive the password code of the electronic key 1. Structurally, the electronic key can be made in the form of a metal non-separable key fob, on the outer surface of which an individual number of this key fob is printed.

 The operating modes of the information reading device are controlled by the central processor 5. For the self-testing of the information reading device, it includes a simulator 7 of the electronic key 1, with which the functionality of all nodes of the information reading device from the electronic key can be checked.

 The password input and user identification unit 13 receives the password code from the information reader and determines whether the user is allowed to work with the information with this password code.

 Information to which access is provided is stored in the storage device 9 in certain memory zones from 1 to N, and there are N access levels to it, depending on the password code. Each password has a strictly defined permitted level of access to information.

 To ensure a strictly defined access, in the control unit 10 for the allowed access level, a table of password codes, the necessary data for the user (last name, first name, middle name, position, individual password) to which this password code is assigned, and the allowed levels of access to information in the storage device 9 are stored Information about the individual password of each individual user is known only to the user. As this individual password, any phrase, word, phrase, digital code, etc. can be used. The use of individual passwords of users whose data are not available in any documentation provide additional information protection. An array of data stored in the block 10 control access, is formed by block 12 input source data. In this case, hierarchical access of individuals (users) is used when the system is turned on for its operation. So, for example, until you enter your data, passwords, one of the representatives of the administration (chief engineer, deputy director, etc.) and a wizard, access for other users (dispatchers) to the information in the storage device will be closed.

 Block 11 registering user access to information registers data on users who accessed certain memory zones, date and time of access, nature of access, data on users who tried to access information that they are not allowed to access.

 The information stored in the storage device 9 is accessed using the information input and output device 4, which is, for example, a keyboard and a monitor and / or printer. If access to information is allowed, the user works with the information.

 The intermediate storage of information and work with it provides random access memory 14.

 The block 15 for cleaning the random access memory device erases the information in the random access memory after the next user has finished working with the information so that the next user cannot use the information in the random access memory left after the previous user had a higher level of access to information.

 The system operating unit 16 controls the operation of the entire device for storing and processing information 3.

 The testing unit, introduced into the information storage and processing device and connected with the system operation unit, the access level permission control unit and the user access information registration unit, is intended for testing the information stored in these units each time the software is turned on, thereby increasing the degree of system reliability.

 Thus, the system of access to information stored in the computer, described by the proposed original set of blocks, as well as the links between them and the functional units, provides high reliability, guaranteed primarily by a high degree of protection against unauthorized access and unauthorized user actions by the system throughout the session their interactions.

Claims (3)

 1. An information access system including an electronic key, an electronic key information retrieval device connected by two-way communication with an information storage and processing device, an electronic key information retrieval device includes a module for interrogating and receiving information from an electronic key connected by a two-way communication with a central processor devices for acquiring information from an electronic key, an electronic key simulator, and one input of an electronic key simulator is connected to the output of the central processor of the device wa information retrieval from an electronic key, and its other input / output - with a module for interrogating and receiving information from an electronic key, the information storage and processing device includes a storage device, a system operation unit, an input data input unit, an information input and output device, an input unit passwords and user identification, access level permission control unit, user access information registration unit, random access memory, online memory cleaning unit, m the storage device contains N memory zones corresponding to N memory access levels, the output of the password input and user identification unit is connected to the first input of the access level permission control unit, the first output of which is connected to each of the N memory zones of the storage device, and the second output is connected to block registration of user access to information, the output of each of the N memory zones of the storage device is connected to the first input of random access memory, the second input-output of which is connected by two-way communication with the input / output of the system operating unit, the third output of which is connected to the input of the cleaning block of random access memory, the output of which is connected to the third input of random access memory, the fourth output of the system operating unit is connected to the first input of the password input and user identification unit and to the second input of the block control of permission level access, in addition, the system operating unit is connected with the input data input unit, the input and output information device and the register unit of access of users to information, and random access memory is connected by two-way communication with an information input and output device, which is connected by another two-way communication with an input data input unit, the output of which is connected to an input of an access level permission control unit, while an electronic key information retrieval device through the port controller it is connected by two-way communication with the block for entering passwords and user identification.  2. The system according to claim 1, characterized in that the module for interrogating and receiving information from an electronic key is configured to generate a probe signal and receive a probe signal modulated by an electronic key.  3. The system according to any one of claims 1 to 3, characterized in that a testing unit is connected to the information storage and processing device, connected by two-way communication with the system operating unit, the access level permission control unit and the user access registration unit for information.