JPH0691531B2 - Security method in data communication - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION (Industrial field of application) The present invention relates to a security system, and more particularly to data communication for preventing damage caused by the theft of a user identification number during data communication of a database service or the like. Regarding the security method in the system.

(Prior Art) Conventionally, in a data communication system such as a database service, as a security method that excludes access by a user who does not have an access right, an identification signal for identifying a user from an access terminal (hereinafter referred to as an ID). ) Is input, the center that has installed a database etc. receives this ID, verifies whether or not the user has the access right, and permits access only when the verification result is the user who has the access right. Is widely adopted. In this method, the ID input to the access terminal is usually modulated by the modem on the terminal side, transmitted to the center side via the transmission path, and the ID demodulated by the modem on the center side is sent to the processor such as a database. It was supposed to receive the above verification.

(Problems to be solved by the invention) In the above-mentioned conventional security method, only the ID sent to the center side can be collated, and the location of the terminal that has input the ID cannot be identified. A person who steals the ID of an authorized user can use the stolen ID to gain access from a terminal in another place where he / she does not originally have the right to access, and is confidential to outsiders who do not have the right to access. There was a problem that it was not possible to prevent damage such as leakage or unlawful billing of users whose IDs were stolen.

An object of the present invention is to solve the above-mentioned problems and provide a security method capable of preventing the occurrence of damage due to ID theft by collating both a user ID and a modem ID.

(Means for Solving Problems) According to the present invention, when a terminal station having an access terminal and a first modem accesses a center station having a second modem and a data processing device to be accessed, the terminal is provided. In the security method of receiving the first identification signal for user identification input from the center station, the presence or absence of the access right of the user is collated, and the access is permitted when the access right is present, The modem stores a second identification signal for modem identification, which is issued from the center station in advance before the access, and is stored in advance in response to a transmission request issued from the center station during the access. Of the second identification signal and the second identification signal which is given by another means in advance and is input from the terminal are collated, and if they match, the second identification signal is generated and returned. And a second modem which is sent back after issuing the transmission request at the time of the access.
In the case of having the access right of both the first and second identification signals, there is provided a modem identification signal collating means for collating the presence or absence of the access right of the first modem in response to the identification signal of The access is permitted only to the user.

(Example) Next, this invention is demonstrated about an Example with reference to drawings.

FIG. 1 is a block diagram showing a data communication security circuit device according to an embodiment of the present invention, and FIG. 3 is a block diagram of an internal configuration of an ID collation / generation circuit in the device shown in FIG. Further, FIG. 2 is a sequence diagram for explaining an operation procedure of signal transmission / reception in the above embodiment. First, in the circuit device of FIG. 1, the terminal 1 and the modem 2 are installed on the access terminal station side, and the modem 4 and the database 5 are installed on the center station side. The terminal and the central office are connected via the public telephone network 3. The access terminal station side modem 2 has a structure in which an ID collation / generation circuit 24 is added and connected to a conventional modem having a terminal interface 20, a transmission circuit 21, a reception circuit 22 and a line interface 23. The center station side modem 4 includes a terminal interface 40 and a transmission circuit 4
1. The ID transmission request circuit 44 is added to the conventional modem including the receiving circuit 42 and the line interface 43.

In this embodiment, the ID collation / generation circuit 24 has a built-in ID memory 25 (FIG. 3) for storing an ID for identifying the modem location transmitted from the center station before access. In order to ensure correct access from a telephone number (that is, location) registered in the database 5 in advance, the center station dials each terminal in advance and transmits an individual modem ID. The modem on each terminal has the ID verification /
The modem is stored in the memory of the generating circuit 24. In addition to the modem ID transmitted from the center station to the terminal, the same modem ID is notified to the terminal side user by another route (eg, mail). When the terminal station accesses the center station, the terminal station makes a call (dial) as shown in FIG. 2, and the center station automatically responds to the call to complete the line connection in the public telephone network 3.

The above operation is the same as the conventional method, but in the present embodiment, after this, the center station side modem 4 sends the circuit 44 to the terminal station.
Issue a request to send the modem ID. The modem 2 receiving this transmission request issues a modem ID transmission request to the terminal 1. The terminal 1 inputs into the modem 2 the modem ID given in advance (given to the user by another route different from the ID loaded in the modem 2). In modem 2, after comparing / verifying with the modem ID stored in advance, if it matches, the modem ID
Send ID. Receiving this, the database 5 verifies step by step whether or not it is the modem ID of the terminal station having the access right, and only when the verification result shows that the access right is present, an affirmative response ACK (1) as shown in FIG. Send to the terminal station. When the collation result shows that there is no access right, the line connection is disconnected after returning a negative acknowledgment (NACK) to the terminal station. Also, in the above comparison / verification in the modem 2, if they are different, a negative response is sent to the center station (not shown in FIG. 2) and the line connection is disconnected.

When the terminal 1 receives the positive response ACK (1), it instructs the user to input the user ID. Similarly, the center station has a modem 4
Sends a signal indicating that communication is possible to the database 5 and waits for access to the database 5. After this, the user ID for identifying the user is input from the terminal 1 in the same manner as in the conventional method, and the processor of the database 5 that receives this checks the ID of the user who has the access right. Only when the collation result indicates that there is an access right, an affirmative response ACK (2) is returned to the terminal station and the online communication between both stations is started.

(Effects of the Invention) As described above, the present invention performs double verification by adding the verification of the modem ID of the terminal station to the verification of the user ID in the conventional method. Before access, it is definitely stored in the modem installed at the location of the telephone number by dialing from the center station. At this time, the modem ID is also notified to the user in parallel (however, the method is by a normal method such as e-mail), and the user inputs the modem ID at the time of access, and the modem ID stored in advance in the modem is used. Security is further enhanced because comparison and matching are performed. That is, when the modem is stolen, it is invalid unless the modem ID is input from the outside. As described above, according to the present invention, there is an effect that it is possible to realize a security method capable of preventing the occurrence of damage due to ID theft and modem theft.

[Brief description of drawings]

FIG. 1 is a block diagram of a security circuit device in a data communication system according to an embodiment of the present invention, and FIG.
Sequence diagram showing the procedure of signal transmission and reception of the embodiment shown in the figure,
FIG. 3 is a block diagram showing the internal structure of the ID collation / generation circuit in the embodiment of FIG. 1 ... Terminal, 2,4 ... Modem, 3 ... Public telephone network, 5 ... Database, 20,40 ... Terminal interface, 21,41 ... Transmission circuit, 22,42 ... Reception circuit, 23, 43 …… Line interface, 24 …… ID collation / generation circuit, 25 …… ID memory, 44 …… ID transmission request circuit.

Claims (1)

[Claims] 1. A user identification first input from the terminal at the time of access from a terminal station having an access terminal and a first modem to a center station having a second modem and a data processing device to be accessed. The center station receives the identification signal of No. 1 and checks whether the user has the access right,
In the security method of permitting the access when there is an access right, the first modem uses a second modem identification signal issued from the center station in advance before the access.
Of the second identification signal for modem identification stored in advance in response to a transmission request issued from the center station at the time of the access, and input from the terminal. The second modem has an identification signal generating means for collating with the second identification signal and generating and returning the second identification signal when they match, and the second modem issues the transmission request at the time of the access. A modem identification signal collating means for collating the presence or absence of the access right of the first modem upon receiving the second identification signal returned later.
A security method, wherein the access is permitted only when both collation results of the first and second identification signals indicate that there is an access right.