JPH02214966A - Security check system for information processing system - Google Patents

Abstract

PURPOSE:To smoothly use and control a distributed information processing system by giving the authentication procedure and the authentication data to a terminal equipment from an information processor for security check and carrying out the subsequent authenticating tasks via the terminal equipment. CONSTITUTION:When a user actuates a terminal equipment 1 for application of an information processor 2, the working state of the equipment 1 is reported to the processor 2 via a terminal state reporting part 10. The processor 2 records the received information in a terminal state holding part 8 and sends the authentication procedure and the authentication data to the equipment 1 via a security check mechanism communication part 7 for security check. The equipment 1 holds the received procedure and data in a security check executing part 9 and carries out the subsequent authenticating tasks via the part 9. Thus the user can smoothly use a distributed information processing system and a controller can easily control the system safety.

Description

[Detailed Description of the Invention] [Field of Industrial Application] This invention relates to distributed information processing in which a plurality of terminal devices and a plurality of information processing devices are connected through a network and can communicate with each other. It concerns a security check method to ensure system safety and smooth use by users.

[Conventional technology]

Conventionally, as a method of this kind, for example, Japanese Patent Application Laid-Open No. 62-67
There was something like what was shown in Public Relations No. 658. FIG. 3 is a block diagram showing the configuration of the security check method of such a conventional information processing system, in which D, (1) is a terminal device, (2) is an information processing device, and (3) is an input/output control unit. ,(
4) is a job execution control section, (5) is a job execution section, and (6) is a job execution control section.
) is the user authentication section. The terminal device (RI) accepts and receives commands and data input by the user and displays the results.The information processing device (2) processes the actual commands.The input/output control unit (3) The commands and data sent from (1) are sent to the job executed by the user.9. Also, the output from the job is sent to the terminal device (1) used by the user.The job execution control unit (4) Recognizes commands and controls the start and end of jobs.Job execution unit (
5) actually executes the job. The user authentication unit (6) authenticates the user when starting to use the terminal device (1).
In such a system, jobs are executed based on the flowchart shown in FIG. First, the terminal device (1) is verified by the user authentication section (6) at the step
After the user is authenticated, the command input from the terminal device (1) is transmitted to the information processing device (1) in step i42.
2), the command is interpreted by the job execution control unit (4) in step 3, and then by the job execution unit (5) in step 441.

The procedure from step (2) where the job is executed to step U is repeated. Therefore, the user of the terminal device (1) must perform authentication when starting to use the information processing device (2).
) commands to the terminal device (1) without performing any authentication steps.
will run until the connection is broken.

[Problem to be Solved by the Invention] When multiple information processing devices using the conventional security check method as described above are connected via a network, a user can use the same terminal device to access the multiple information processing devices connected via the network. When using a computer, an authentication procedure must be performed as a security check every time the information processing device used is changed, which prevents the user from using multiple information processing devices quickly and smoothly. There was a point. Another problem is that when different models of information processing apparatuses are connected via the network, the user must understand and memorize the authentication procedure for each model.

This situation affects not only the users of information processing devices, but also
This also applies to administrators of information processing equipment. An administrator of an information processing device must perform processing and monitoring for all information processing devices to maintain the safety of all information processing devices under management.

Another problem was that it increased the workload of administrators.

This invention was made to solve the above-mentioned problems, and improves the security of information processing devices in a distributed information processing system in which multiple terminal devices and multiple information processing devices are connected via a network. By sending the authentication procedure and authentication data for security checks from the information processing device to the terminal device, and performing subsequent authentication on the terminal device, it is possible to facilitate the use and management of the distributed information processing system for users and administrators. The purpose is to provide a method to do this.

[Means for addressing issues]

A security check method for a distributed information processing system according to this invention includes a security check mechanism in which an information processing device performs a security check and sends authentication procedures and authentication data to a terminal device, and a security check mechanism communication unit that maintains the status of the terminal device. The device includes a terminal status holding unit, a terminal status notification unit for notifying the terminal status of the terminal device, and a security check execution unit for executing authentication notified from the information processing device.

A system that unifies the security check method when users and information processing equipment managers use multiple information processing equipment (by having the terminal device perform the authentication for the user to use the information processing equipment). By making it possible to
This enables the users of the distributed information processing system to use it smoothly, and allows the administrator of the information processing system to easily control the security of the system.

[Effect]

In this invention, when a user activates a terminal device to use an information processing device, the terminal status notification section informs the information processing device that the information processing device performs a security check of the distributed information processing system when the terminal device is activated. The information processing device records the information in the terminal status holding unit. The information processing device sends an authentication procedure for security check and authentication data to the terminal device using the security check mechanism communication unit. The terminal device stores the authentication procedure and authentication data sent from the information processing device in its security check execution unit, and performs subsequent authentication by the security check execution unit of the terminal device.

connected by a network. When using another information processing device using the same terminal device, the information processing device sends an authentication procedure that does not require authentication of all information processing devices. A plurality of information processing devices can be smoothly used without performing authentication for each information processing device.

At this time, even if other information processing devices are authenticated, the same authentication procedure is executed when the user uses them, so the user must remember the unique authentication procedure for each of the multiple information processing devices. There is no need to store it. Further, by performing the authentication procedure between the terminal device and the corresponding information processing device, authentication for each information processing device can be omitted.

In addition, the work for security checks to ensure the safety of multiple information processing devices managed by the administrator is as follows:
It is only necessary to perform the authentication procedure and the information processing device that sends the authentication data, making it possible to perform a unified security check not only regardless of the type of information processing device but also across the entire 8 distributed information processing system. Therefore, security checks can be performed on all information processing devices at the level desired by the administrator.

[Embodiments of the invention]

FIG. 1 shows a distributed information processing 3ff showing an embodiment of the present invention.
It is a block diagram of the security check method of i-system, and (1)-(6) are the same as the said Example. O
j is another terminal device connected via the network.

(2)' is another information processing device connected via a network. (7) is a security check mechanism communication unit that notifies the terminal device of the authentication procedure and authentication data for which the information processing device (2) performs a security check.

(8) is notified that the terminal device (1) has become operational.

This is a terminal state holding unit that holds the state. (9) is a security check execution unit that executes the security check mechanism notified by the information processing device (2), and α is a security check execution unit that notifies the terminal device (1) that it is in the working state. This is the terminal status notification unit. σB is the terminal device (1
) is a communication processing unit for communicating with the information processing device (2). (12 is a terminal control unit that performs display and input on the terminal device (1). a& is a network for connecting the terminal device (11) and the information processing device.

In a system having such a configuration, a security check is performed based on the flowchart of the terminal device (1) and information processing device (2) shown in FIG.

First, in step cII), the information processing device (2) waits for the terminal device (1) to become operational. At this time, step Gυ
Terminal status notification unit a [communication processing unit (Ill) is used to notify network 1 that terminal device (1) has become operational.
Notification will be made via 31. This allows Step
Then, the terminal status holding unit (8) is notified via the input/output control unit (3) of the information processing device (2) that the terminal device has become operational. In this step, the terminal status holding unit (8) sends the security check mechanism communication unit (
7) will be notified to send the authentication procedure and authentication data.

In step (to), the security check mechanism communication department (7)
) receives the authentication procedure and authentication data of the information processing device (2) and (21') from the user authentication section (6). In step □□□, the security check mechanism communication section (7) receives the information processing device ( 2) and I2f authentication procedure and authentication data are passed to the input/output control unit (3) and sent to the terminal device (1) via the network a3.In step 3, the information processing device (2) performs input/output control. The command sent through section (3) is sent to job execution control section (4).Step
Then, the job execution control unit (4) interprets the command.

If the command interpreted in step (sub) is an end command, then in step ω, the state of the terminal status holding unit (8) is set such that the terminal device (1) is not in the operating state. after that.

Execution is performed again from step at+. If the command interpreted by step name is not a termination command, step (
Execute again from b). In steppe countries.

The terminal device (1) is waiting for the authentication procedure and authentication data from the information processing device (2). In step (c), the authentication code II sent from the information processing device (2) by the step rut
and authentication data are held in the security check execution unit (9) through the communication processing unit all. In step (2), the security check execution unit (9) references the received authentication procedure to the authentication data and executes the authentication. At the step arc, the terminal control unit +121 waits for multiple input commands, and checks the type of command input at the step can. If the change command is for the information processing device (2) in step ar, connection is made with another information processing device f21' in step (2). At this time, Step 1 is executed, the terminal device (11 authenticates the information processing device (2r), and the information processing device t (2f) becomes in use.

If the user is not authenticated, a warning is sent to the user through the security check execution unit (9) and the multi-terminal control unit a2, and the information processing device (the use of two guns is not permitted. In step (9), the information processing device If it is not the change command in (2), the command is sent through the communication processing unit (1il) in step (to).In step on, the command is sent to the information processing device (1il).
If it is a change command of 2), in step (to) the connection with the other information processing device +21 is made through the communication processing unit all, the process returns to step 1, and in step (e) the information processing device ( The information processing device (2f) is authenticated based on the authenticator IA of zr and the authentication data.

Therefore, in this security check method for a distributed information processing system, since authentication is automatically performed by the terminal device, there is no need for the user to perform an authentication procedure when using another information processing device.

Furthermore, the administrator of the information processing devices can centrally manage the security checks of all the information processing devices connected through the network using one information processing device.

Note that the authentication data sent in step 4 is only for a specific information processing device, and in step 371 in which the user changes the information processing device used, the authentication data of the newly used information processing device (2) is sent as information. The same effect can be obtained even if the information is sent from the security check mechanism section 1tf of the processing device (2f).

Furthermore, in the above embodiment, one representative information processing device sends the authentication procedure and authentication data to the security check section, but it is arranged so that the authentication procedure and authentication data are sent to the terminal device by a plurality of information processing devices. It is also possible. In this case, it is possible to prevent the safety of other information processing devices from being compromised due to a failure of a specific information processing device.

〔Effect of the invention〕

As described above, according to the present invention, a user can easily use any information processing device in a distributed information processing system without compromising the security of the information processing device, and an administrator can easily use any information processing device in a distributed information processing system. This has the effect of reducing the amount of data that must be managed to ensure the safety of the information processing device.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of the present invention, and FIG. 2 is a flowchart showing the operation of this embodiment. FIG. 3 is a block diagram showing a security check method of a conventional information processing system, and FIG. 4 is a flowchart showing its operation. In the figure, (11, (+1 is the terminal device, (2+, (2f is the information processing device, (3) is the input/output control unit, (4) is the job execution control unit, (5) is the job execution unit, (6 ) is the user identification section, (7) is the security check mechanism communication section, (8) is the terminal status holding section, (9)
is a security check execution unit, +11) is a terminal status notification unit, αB is a communication processing unit, α2 is a terminal control unit, +1
3 is a network. In addition, the same reference numerals in each figure indicate the same or equivalent parts, (
xf indicates a different device with the same functionality as (Xl).

Claims (1)

[Claims] In a security check of a distributed information processing system in which a plurality of terminal devices and a plurality of information processing devices are connected via a network and can communicate with each other, an authentication procedure and authentication data for performing a security check on the information processing device are sent to the terminal device. A security check mechanism communication unit that sends a message to a security check mechanism, and a terminal status holding unit that is notified that the terminal device is in an operating state, and executes a security check procedure that is notified to the terminal device by the information processing device. 1. A security check method for an information processing system, comprising a terminal status notification unit that notifies the information processing device that the terminal device is in an operating state.