JPH02226456A - Computer system - Google Patents

Abstract

PURPOSE:To prevent the unjust use of a computer by means of others by permitting a user to use the computer from a terminal only when a pair of a first identification code which the user inputs and a second identification code recorded in a card which the user uses is registered in an identification code table installed in the computer. CONSTITUTION:The user can use the computer 11 from the terminal 15 only when a pair of the first identification code which the user inputs and the second identification code recorded in the card 16 which the user uses is registered in the identification code table 19 installed in the computer 11. Thus, the other persons cannot unjustly use the computer 11 unless he uses the card 16 which the user has even if the first identification code (password) which the user inputs is known to the others. The code content of the second identification code (new password) is not known by the user himself and he does not need to know it. Thus, it cannot be leaked out, and the code length can considerably be prolonged, whereby it is difficult to decode it.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Industrial Application Field) The present invention relates to a computer system in which a computer is used from a terminal via a communication port or line, and particularly relates to a method for preventing unauthorized use of a computer.

(Prior art) In a computer system that uses a center computer (host computer) from a terminal via a communication line (public line network, private line network, etc.), preventing unauthorized use of the computer is one of the important issues.
It is one. Conventional methods to prevent this unauthorized use include: ■ using a password, and ■ once the terminal is connected to the computer, the connection is disconnected and the computer is reconnected to a registered number. known from. In general, there are systems that apply the above method (1) and systems that use both methods (1) and (2) in combination.

However, in a system that uses only the above method (■), if someone other than the authorized person tries various passwords and learns the correct password, it can easily be used fraudulently. It was also extremely difficult to discover what was being done. Since the above-mentioned password relies on the memory power of the user (authorized person), it is relatively short and therefore relatively easy to learn through various attempts. On the other hand, in a system that uses both Methods (2) and (2), the terminals that can be used are fixed, which is inconvenient if you want to move around and use them.

(Problem to be Solved by the Invention) As mentioned above, in the past, it was difficult to increase the password length, and for this reason, it was relatively easy for people other than those who were not officially registered to find the password through various attempts. Therefore, it was difficult to prevent unauthorized use of computers using password-based methods.

Therefore, the problem to be solved by this invention is to prevent a password from being known to others, and even if it is known, to prevent unauthorized use of a computer by another person.

[Structure of the Invention] (Means for Solving the Problems) This invention provides a method for reading/writing a second identification code for a card to which a first identification code is assigned and a second identification code is recorded. A card input/output means is provided for each terminal using the computer via a communication line, and the computer has a second identification code recorded on a card to which the same code as the first identification code is assigned. An identification code table is provided in which pairs of codes are registered for each card, and the first identification code input by user operation and the second identification code read by the card input/output means are transmitted from the terminal to the computer. , checks in the computer whether or not the pair of the first identification code and the second identification code from this terminal is registered in the identification code table, and allows use of the own computer only if it is registered, and The second identification code of the corresponding identification code table is
At the same time as re-registering the identification code, this other Ts2 identification code is sent to the terminal, and the second identification code recorded on the card set in the terminal is read by the card input/output means corresponding to this terminal. This is characterized in that the second identification code is rewritten to another second identification code. Further, in the present invention, the second identification code read by the card input/output means is encrypted with the first identification code input by the user in the terminal or computer, and the encrypted second identification code is encrypted. It is preferable to use the first identification code after decoding it in a computer.

(Operation) According to the above configuration, the first identification code input by the user and the second identification code recorded on the card used by this user are
The user can use the computer from the terminal only if the pair with the identification code is registered in the identification code table provided in the computer.

Therefore, even if someone else learns the first identification code (equivalent to a conventional password) entered by a user (authorized registrant), that person will be able to use the computer fraudulently as long as the user does not use a card owned by the user. Can not do it. In addition, since the second identification code (new password) recorded on the card owned by the user does not know or need to know the contents of the code, there is no risk of it being leaked to others, and the length of the code can be kept extremely long. It is also difficult to decipher because it has 11 abilities. Furthermore, if a method of encrypting the second identification code with the first identification code is applied, the above-mentioned deciphering becomes even more difficult, and unauthorized use of the computer can be more reliably prevented.

(Embodiment) FIG. 1 is a block diagram showing a computer system according to an embodiment of the present invention. In the figure, 11 is a host computer that forms the center of the system, 12 is a communication line network, for example, a public line network, 13.14 is a host computer 112, and terminals 15, which will be described next, are connected to the public line network 12 for use. modem.

15 is a terminal connected to the host 51-computer II via the public RI'II line 2. There are multiple terminals of this type in the system, but for convenience, only one is shown in Figure 1.
Only the stand is shown.

1G is a card, for example, an IC card, distributed to authorized registrants who are allowed to use the host computer 11.

A key (first identification code) as a first password is assigned in advance to (the owner of) the IC card 113, and the owner of the IC card 16 memorizes this key. The IC card 16 stores an identification code (second identification code) as a second password. 1
Reference numeral 7 denotes an ICC card input/output device into which an IC card 16 can be set and which performs information output between the IC card 16 and the set IC card 16 . The IC card I6 provided and set corresponding to this ICC card small output device 17 terminal 15
Terminal 1 that reads the identification code stored in
5, and a function to rewrite the identification code stored in the IC card 16 into an identification code output from the terminal 15 upon request from the terminal 15.

In addition to a well-known configuration such as a keyboard and a display monitor, the terminal 15 also encrypts the identification code read by the ICC card input/output device 17 using a key input by the user.
The conversion unit has an encryption function for decoding) and a decryption function for decoding (encoding) an identification code (encrypted identification code) sent from the host computer 11 using the above-mentioned key. On the other hand, the host computer 11 stores the key assigned to the authorized registrant (IC card 16 distributed to) and the IC card distributed to the authorized registrant to whom the same key is assigned.
It has an identification code table 19 in which a pair with the identification code stored in the card 1G is registered for each authorized registrant (IC card 18).

The host computer 11 has a function of checking the validity of the key and identification code transmitted from the terminal I5 by referring to the identification code table I9, and if they are correct, permitting the use of the terminal 15 and transmitting a new identification code to the terminal 15. have.

Next, the operation of the configuration shown in FIG. 1 will be explained with reference to the flowchart shown in FIG.

When a user wants to use the host computer 11 of the system shown in FIG. Perform login operations. That is, the user enters the key (corresponding to a conventional password) and username assigned to him/her on the terminal 1.
5, input means is operated such as a keyboard (step 511).

This key and user name are sent to the host computer 11 via the public line network 12. The host computer 11 checks the validity of the key sent from the terminal 15 and the user name. The steps up to this point are the same as before except for the operation of setting the IC card 1G. host computer 11
If the pair of key and user name from the terminal 15 is registered in advance, that is, if the key is correct,
The public line network 1 requests the terminal 15 to send an identification code.
Send via 2.

The identification code transmission request from the host computer 11 is sent to the terminal 1.
The conversion unit I8 in 5 is notified. As a result, the converter 18
is the IC card 16 for the IC input/output device I7.
Instructs to read the identification code from.

In response to this instruction, the IC card input/output device I7
IC card 1G set in 7 (same card I)
The conversion unit 18 reads the identification code (stored in G) and converts it to
(step 512). The conversion unit 18c converts the identification code passed from the IC card input/output device I7 into step S.
The data is encrypted (decoded) using the key input in step S11 (step S13). The identification code encrypted by the converter 18 is transmitted from the terminal I5 to the host computer 11 via the public line network 12 (step 514).

When the host computer 11 receives the identification code (encrypted identification code) sent from the terminal 15, it decrypts (encodes) it using the previously received key, and creates a pair of this key and the decrypted identification code. It is checked with reference to the identification code table 19 whether it is registered in the identification code table 19, that is, whether it is correct (step S).
21). If it is registered in the identification code table I9, the host computer 11 determines that the key and identification code pair from the terminal I5 is an invalid one, and creates a new identification code to replace this identification copy. (Step 522). Then, the host computer 11 changes the identification code of the corresponding entry in the identification code table 19 used for the determination of validity to the new identification code created in step S22 (step 823). Next host +i I'
The computer 11 encrypts this new identification code with the corresponding key and transmits it to the terminal 15 (step 524).

The new identification code sent from host computer 11 is terminal 1
5 and is received. The conversion unit 18 of the terminal 15 decrypts this new identification code from the host computer 11 using the key input in step Sll (step 816). Then, the converter 18 converts this decoded new identification code to the IC car 1.
The code is passed to the human output device 17 to instruct writing of the same code. As a result, the IC car single person output device 17
The identification code stored in the IC card 16 set in the IC card 16 is changed to the new identification code passed from the conversion unit 18 (step 517). In this embodiment, upon completion of step S17, the user The host computer 11 can be used as before using the terminal 15.

In the above embodiment, the Pubetsu code read by the IC card input/output device 17 is transferred to the terminal 15 (the converter 18 of the terminal 15).
In the above description, the information is encrypted and sent to the host computer 11, but the host computer 11 may also encrypt the information. Such encryption (and decryption) of the identification code is certainly effective for deciphering the identification code. However, in this embodiment, the identification code is the IC card I
Since it is written to G and the user does not need to remember it,
Unlike conventional passwords, a complicated and long code can be used, and therefore sufficient protection against decryption can be achieved without applying encryption (and decryption).

Furthermore, in the embodiment described above, the IC card input/output device 17 is provided outside the terminal 15, and the conversion section 18 is provided inside the terminal 15. Whether it is provided or not is not essential. Furthermore, in the embodiment described above, a system was described in which the host computer 11 is used from the terminal 15 via the public line network 12. It can be similarly applied to systems that use ■.

[Effects of the Invention] As detailed above, according to the present invention, the following effects can be achieved.

■ The computer is equipped with a pair of a first identification code (key equivalent to a conventional password) input by the user and a second identification code (new password) recorded on the card used by this user. A user can use a calculator from a terminal only if it is registered in the identification code table, so even if the first identification code assigned to a legitimately registered user (to the card he/she owns) is known to someone else, , other people cannot use the computer fraudulently unless they use a card owned by this user.

Conversely, even if this card is used, the computer cannot be used unless the user knows the corresponding first identification code.

(2) The second identification code is recorded on the card, and since the user himself/herself does not know the contents of the code, there is no risk of it being leaked to others. Furthermore, since the user does not need to memorize the contents of the second identification code, a complex and long code can be used, making it extremely difficult to decipher.

■ Even if the second identification code is decoded by someone else, this code is changed each time it is used, so even if the first identification code is also known, unauthorized use can only be done once. . Furthermore, even if the contents of the card are copied to another card by another person, the second identification code will be changed each time it is used as described above, so if an authorized user uses the calculator first, , the copied card will no longer be usable. In the opposite case, since the authorized user will not be able to use the computer the next time they log in, they will be able to notice unauthorized use and take countermeasures.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of a computer system according to an embodiment of the present invention, and FIG. 2 is a flowchart for explaining the operation. 11...Host computer, 12...Public line network, 15
...Terminal, 16.. IC card, 17.. IC card input/output device, 18.. Exchange section, 19.. Identification code table.

Claims (3)

[Claims] (1) In a computer system in which a computer is used from a terminal via a communication line, a card to which a first identification code is assigned and a second identification code is recorded; a card input/output means provided in each of the above terminals for reading/writing the information; means for transmitting the second identification code read by the output means to the computer; and the second identification code recorded on the card provided in the computer and to which the same code as the first identification code is assigned.
an identification code table in which a pair with an identification code is registered for each card; and whether a pair of the first identification code and second identification code transmitted from the terminal is registered in the identification code table. check whether the computer is registered, permit use of the computer only if it is registered, and re-register the second identification code in the corresponding identification code table as another second identification code, and also register the corresponding second identification code in the identification code table as another second identification code. and means for transmitting the second identification code to the terminal, and the card input/output means is configured to transmit the second identification code recorded on the card when the separate second identification code is transmitted from the computer to the corresponding terminal. 2. A computer system characterized in that the computer system is configured to rewrite the second identification code to the other second identification code. (2) In a computer system in which a computer is used from a terminal via a communication line, a card to which a first identification code is assigned and a second identification code is recorded; and the second identification code for this card. a card input/output means provided in each of the above terminals for reading/writing data; and a card input/output means provided in each of the above terminals, into which an arbitrary first identification code is input, and the input first identification code is used as a key to enter the card input/output means for each of the terminals. means for encrypting the second identification code read by the input/output means and transmitting the encrypted second identification code and the input first identification code to the computer; An identification code table in which a pair of the first identification code and the second identification code recorded on the card to which the same code is assigned is registered for each card, and a first identification code sent from the terminal. The encrypted second identification code paired with the identification code is decrypted using the identification code as a key, and the pair of the first identification code and the decrypted second identification code is registered in the identification code table. check whether the computer is registered, permit the use of the computer only if it is registered, re-register the second identification code in the corresponding identification code table as another second identification code, and register the corresponding second identification code in the identification code table again. and a means for encrypting a second identification code using the first identification code as a key and transmitting the encrypted code to the terminal, and the terminal receives another encrypted second identification code from the computer. , the card input/output means decodes the same code using the input first identification code as a key, and the card input/output means decodes the second identification code recorded on the card into the other code decoded by the corresponding terminal. A computer system configured to rewrite to a second identification code. (3) In a computer system in which a computer is used from a terminal via a communication line, a card to which a first identification code is assigned and a second identification code is recorded; a card input/output means provided in each of the above terminals for reading/writing the information; means for transmitting the second identification code read by the output means to the computer; and the second identification code recorded on the card provided in the computer and to which the same code as the first identification code is assigned.
An identification code table in which a pair with an identification code is registered for each card, and a second identification code from the terminal that is paired with the same code using the first identification code sent from the terminal as a key
an encryption means for encrypting an identification code; and using the first identification code from the terminal as a key, decrypt a second identification code encrypted by the encryption means, and decrypt the second identification code from the first identification code. Checking whether the pair of decoded second identification codes is registered in the identification code table,
Use of the computer is permitted only if the computer is registered, and the corresponding second identification code in the identification code table is re-registered to another second identification code, and this second identification code is registered again.
means for transmitting an identification code to the terminal, and the card input/output means is configured to transmit the second identification code recorded on the card when the separate second identification code is transmitted from the computer to the corresponding terminal. A computer system characterized in that the computer system is configured to rewrite the second identification code to the other second identification code.