JP2003085042A - Security system of computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security system capable of preventing illicit use of a computer even when a password is stolen. SOLUTION: This system is equipped with a resister switch part 113 for setting a processing prohibition item for prohibiting processing to be executed by a processing means, and when a processing instruction received though a network 110 is pertinent to the processing prohibition item set by the resister switch part 113, the processing means does not execute processing corresponding to the processing instruction. Hereby, even when illicit intrusion is performed through the network 110 by stealing the password, illicit processing can be inhibited.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer security system for protecting a computer from hackers and the like.

[0002]

2. Description of the Related Art Conventionally, computers have been used for various purposes including a server system connected to a network. A security system is used to protect the computer, particularly a computer used by connecting to a network, from hacker attacks and the like.

The security system that has been conventionally adopted is a software security system. The software-based security system only permits the use of a legitimate password.

As a result, it is possible to give a use permission to the password of the user within a preset authority range, and prevent unauthorized use by a person who does not have the password.

[0005]

However, in the above security system using software, if the password is stolen and the administrator authority is robbed, the system can be destroyed or tampered freely. Particularly, in a server system or the like, a huge amount of data software is stored in a storage device such as a magnetic disk, and if the data or the like is tampered with or tampered with, the data will be seriously damaged.

An object of the present invention is to provide a security system capable of preventing unauthorized use even if a password is stolen.

[0007]

According to the present invention, a storage unit, an operating unit, and a processing unit for receiving a processing command via a network or from the operating unit and executing a process according to the processing command. And a hardware switch unit in which a processing prohibition item for prohibiting processing by the processing unit is set, wherein the processing unit is a process received via the network or from the operation unit. A security system is provided in which, when an instruction corresponds to a processing prohibition item set by the hardware switch unit, the processing corresponding to the processing instruction is not performed. The processing means does not perform the processing corresponding to the processing command when the processing command received via the network or from the operating means corresponds to the processing prohibition item set in the hardware switch unit.

[0008] Here, a processing prohibition item for prohibiting processing on the storage device is set in the hardware switch section, and the processing means, when the processing command corresponds to the processing prohibition item, You may comprise so that the process corresponding to the said process instruction may not be performed.

Further, the processing means may be configured to reset the computer when receiving a processing command corresponding to the processing prohibition item.

Further, it may be configured so as to include control means for receiving the information indicating the processing prohibition item via a network and setting the processing prohibition item in the hardware switch section.

Further, the control means is further configured to include a reset signal generating means for generating a reset signal for resetting the computer in response to a reset request signal received via a network. May be.

[0012]

DETAILED DESCRIPTION OF THE INVENTION A computer security system according to an embodiment of the present invention will be described below with reference to the accompanying drawings.

FIG. 1 is a block diagram showing a computer security system used in the embodiment of the present invention, and shows an example in which a Web server is used as a computer.

In FIG. 1, the Web server system 10
0 is a control device 101, a central processing unit (CPU) 10
2. An input device 103 including a keyboard and a mouse, which constitutes an operating means, a main memory 104, and a PCI
(Peripheral Component Interconnect) bus 105,
The external storage device 106 and the server system 100 are connected to a first network (the Internet in this embodiment) 110.
Communication interface (NIC) for connecting to
107 and a computer terminal 108 connected to the server system 100 via a second network (intranet in this embodiment) 109.

The terminal 108 has a built-in web browser, and is configured to operate the web server 115 using the browser, as will be described later.

The CPU 102 executes the software stored in the memory 104 out of the software stored in the storage device 106, thereby executing a process according to a processing command received via the network 110 or from the input device 103. . Here, the CPU 102 constitutes a processing means. The processing command may be input from at least one of the network and the input device 103.

The control device 101 includes a SCSI (Small Computer System Interface) interface 117 connected to the bus 105, a SCSI and an IDE (Integrated Dev).
a converter 111 for converting ice electronics), an IDE interface 112 connected to the storage device 106,
A register switch unit 113 for setting an item (processing prohibited item) that prohibits processing by the processing unit, a reset signal generation unit 114 that configures a reset signal generation unit and generates a reset signal, a Web server function unit 115, and the server system 100. And a second communication interface 116 for connecting to the network 109. Here, the reset signal generation unit 114, the Web server function unit 115, and the communication interface 116 form a control unit. still,
The control device 101 is composed of one printed circuit board, and is configured to function by mounting the circuit board in a predetermined slot of the server 100.

The register switch section 113 has a switch having a plurality (N) of register configurations for setting an application (AP) call request flag. The AP call request flag is a flag for requesting the processing means to prohibit the processing by the processing means.
By setting the AP call request flag in the register switch unit 113, an item (processing prohibition item) for prohibiting the processing by the processing means is set. Network 11
When the processing command received via 0 or from the input device 103 corresponds to the processing prohibition item set by the register switch unit 113, the processing means operates so as not to perform the processing corresponding to the processing command.

The reset signal generator 114 outputs a reset signal to the CPU 102 in response to the reset request signal received from the Web server function unit 115.

The Web server function unit 115 has the terminal 108.
Is provided with a function as a Web server. For example, when the terminal 108 connects to the server 100,
The setting screen of the register switch unit 113 is displayed on the display unit (not shown) of the terminal 108 by the Web server function unit 115, and the administrator operates the terminal 108 to cause the register switch unit 113 to display the processing prohibited items. It is configured to be able to set. In addition, a display screen for transmitting a reset request signal to the server 100, a setting screen for setting attributes of the storage device 106, and the like are also displayed on the display unit of the terminal 108, and the terminal 108 is operated. As a result, it is possible to send a reset request signal to the server 100 and set the attributes of the storage device 106.

A plurality of storage areas (partitions) are set in the storage device 106, and an operating system (OS) and administrator commands (for example, the storage device 10) are set.
Format processing commands and rewriting processing commands for 6), software such as an administrator tool (for example, network setting tool and server 100 setting tool), and data such as content data are stored. As described above, the attributes (attributes such as readable and read-only) of each storage area in the storage device 106 can be set from the terminal 108.

The operation of the present embodiment will be described in detail below with reference to FIG.

First, the administrator operates the Web browser of the terminal 108 to cause the terminal 108 to operate on the network 1.
09 and the communication interface 116, the terminal 10
8 connects to the Web server function unit 115. As a result, a screen for setting the switch unit 113 is displayed on the display screen of the terminal 108, and the administrator sets the plurality of register switches included in the switch unit 113 while watching the screen, and thereby the switch The processing prohibited items are set in the section 113.

For example, of the register switches included in the switch unit 113, the first register switch is turned on to "memory device 106 is prohibited from formatting", and the second register switch is turned on. It is set to "prohibit rewriting processing in storage device 106". In this way, the processing prohibited items are set in the switch unit 113 via the intranet, which is effective in terms of security. The switch unit 11
3 may be configured by a DIP switch, and the processing prohibited item may be directly set in the switch unit 113 by a manual operation. Moreover, you may comprise by other hardware switches.

In this state, it is assumed that an unauthorized access is made from the terminal (not shown) via the network 110 using the password of the administrator, and an instruction to format the storage device 106 is issued.

In this case, the processing means receives the format processing command and confirms the setting content (flag) of the switch unit 113. The processing means is a switch unit 113.
When it is detected that the storage device 106 is prohibited from being formatted, the formatting process is not performed. The processing means may reset the server system 100 by determining that a processing instruction has been illegally issued. As a result, it is possible to prevent illegal processing from being performed.

Even when the contents of the storage device 106 are to be illegally rewritten, the switch unit 113 is provided with the storage device 106.
Since there is a setting that prohibits rewriting processing to
Similarly to the above, the processing unit detects that the switch unit 113 is set to prohibit the rewriting process of the storage device 106, and does not perform the rewriting process of the storage device 106. This prevents unauthorized rewriting of the storage device 106. Also in this case, the processing means is the server 10.
You may reset 0.

Next, the operation of forcibly resetting the server 100 from the terminal 108 will be described. Server 100
Is illegally accessed or performs an abnormal operation, the server 108 can be forcibly reset from the terminal 108.

When the server 100 is forcibly reset from the terminal 108, the administrator operates the terminal 108 so that the terminal 108 sends a reset request signal to the server 100. The reset request signal is sent to the network 1
09, and is transmitted to the Web server function unit 115 via the communication interface 116. Web server function unit 115
Receives the reset request signal and outputs the reset request signal to the reset signal generator 114. The reset signal generation unit 114 receives the reset request signal from the Web server function unit 115 and transmits the reset signal to the CPU 102. The CPU 102 forcibly performs the reset process of the server system 100 in response to the reset signal.

As described above, the computer security system according to the embodiment of the present invention receives a processing command via the storage device 106, the input device 103, the network 110 or from the input device 103, and A computer security system including a processing unit that executes a process according to a processing instruction includes a register switch unit 113 in which a processing prohibited item that prohibits processing by the processing unit is set, and the processing unit includes the network 110. When the processing command received via the or from the input device 103 corresponds to the processing prohibition item set by the register switch unit 113, the processing corresponding to the processing command is not performed. Therefore, it is possible to prevent unauthorized use even if the password is stolen. Further, since the processing prohibition item is set by the register switch, it is possible to more reliably prohibit the illegal processing even in the case of illegal intrusion.

Further, a processing prohibition item for prohibiting the processing on the storage device 106 is set in the register switch unit 113, and the processing means performs the processing when the processing command corresponds to the processing prohibition item. The processing corresponding to the instruction is not performed. Therefore, it is possible to prevent the contents of the storage device 106 from being destroyed.

In the present embodiment, the Web server system has been described as an example, but the present invention can be applied to a general computer.

[0033]

According to the computer security system of the present invention, it is possible to prevent unauthorized use even if a password is stolen.

It is also possible to prevent the contents of the storage device from being destroyed.

[Brief description of drawings]

FIG. 1 is a block diagram of a Web server according to an embodiment of the present invention.

[Explanation of symbols]

100 ... Web server system 101 ... Control device 102 ... CPU constituting processing means 103 ... Input device constituting operation means 104 ... Main memory 105 ... PCI bus 106 ... Storage device 107 ... Communication interface 108 ... Computer terminal 109, 110 ... Network 111 ... SCSI-IDE converter 112 ... IDE interface 113 ... Register switch unit 114 ... Reset signal generation unit constituting control means 115 ... Web server function unit constituting control means 116 ... Communication interface constituting control means 117 ... SCSI interface

Claims (7)

[Claims] 1. A computer security system comprising: a storage device, an operating means, and a processing means for receiving a processing instruction via a network or from the operating means and executing processing according to the processing instruction. The processing means includes a hardware switch unit in which a processing prohibition item for prohibiting processing by the processing unit is set, and the processing unit is configured such that a processing command received via the network or from the operation unit is set in the hardware switch unit. The security system is characterized in that the processing corresponding to the processing command is not performed when the processing prohibition item is satisfied. 2. A processing prohibition item for prohibiting processing on the storage device is set in the hardware switch unit, and the processing unit is configured to perform the processing when the processing command corresponds to the processing prohibition item. The security system according to claim 1, wherein processing corresponding to the processing instruction is not performed. 3. The security system according to claim 1, wherein the processing unit resets the computer when receiving a processing command corresponding to the processing prohibition item. 4. The control means for receiving the information indicating the processing prohibition item via a network and setting the processing prohibition item in the hardware switch unit. The security system according to any one. 5. The security system according to claim 4, wherein the network is an intranet. 6. The security system according to claim 1, wherein the processing switch item is set by a manual operation in the hardware switch unit. 7. The control means further comprises reset signal generating means for generating a reset signal for resetting the computer in response to a reset request signal received via a network. The security system according to any one of claims 4 to 6.