JP2001350670A - Information management device and system, and recording media with information erasing function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information management device surely preventing a specific information from being leaked to a third person. SOLUTION: This information management device, e.g. a hard disk 30, is provided with a setting means setting the erasing conditions for erasing a specific information recorded on a recording medium 32, a judging means judging whether the present situation satisfies predetermined erasing conditions or not, and an additional substrate 33 having an erasing means erasing the information recorded on the recording medium 32 when the present situation satisfies the erasing conditions. The specific information is autonomously erased or invalidated while being kept unrecognized by the third person.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security technique for preventing management information such as personal information and sales information from leaking outside.

[0002]

2. Description of the Related Art In recent years, it has become common to manage information such as customer personal information and sales information with a computer for business purposes. Such management information is usually recorded on a hard disk of a computer or a portable recording medium such as a memory card. In this case, there is a problem in preventing information leakage to a third party when the computer or the recording medium is stolen or misplaced. As a method of preventing information from leaking to a third party, encryption of the information has been widely performed conventionally. However, it is necessary to prepare dedicated software in order to introduce the encryption technology, which is costly. In addition, when an encryption technology is introduced, it is necessary to strictly manage a key and a password so that the encrypted information can be read. An object of the present invention is to provide a mechanism capable of reliably preventing information leakage to a third party without introducing an encryption technology.

[0003]

In order to solve the above-mentioned problems, the present invention provides an information recording medium for recording specific information, and an erasing condition for erasing the specific information recorded on the information recording medium. Setting means for setting an information range to be erased and a method of erasing; determining whether a current situation satisfies the erasing condition; and if so, a specification recorded on the information recording medium. There is provided an information management apparatus having an autonomous erasing means for autonomously erasing information according to the set information range and erasing method.

[0004] All or part of the erasure condition, information range and erasure method set by the setting means are preferably
Along with the specific information, it can be received from an external device such as a computer to which the own device is connected. By doing so, it is not necessary to delete information unless specific information is acquired, so that the load on the information management device is reduced. in this case,
It is determined whether the power of the computer is on or off, and when it is determined that the power is on, the erasing condition or the like is received from the computer. During the transition from the OFF state to the ON state, the reception of the erasure condition and the like is refrained.

[0005] The setting means, the judgment means and the autonomous erasing means comprise:
Although it can be realized by hardware, it may be realized based on a program code that can be read by its own device. The program code itself disappears after the specific information is erased. As a result, there is no trace of the existence of the specific information and the erasure of the specific information, and it does not give a third party an opportunity to analyze the information. In consideration of the importance of the specific information, instead of immediately deleting when the determination unit determines that the erasure condition is satisfied, the operator is authenticated and erased only when the operator authentication fails. Is preferred.

[0006] The present invention also provides an information management system comprising a first device and a second device capable of exchanging information with each other. When transmitting the specific information stored in the first device in response to a request from the second device, the first device also transmits a program code for autonomously deleting the specific information under predetermined conditions. Along with the program code
An information recording medium that records the specific information and the program code received from the first device, and determines whether a current situation satisfies the condition, And autonomous erasing means for autonomously erasing the specific information recorded on the information recording medium by activating and executing the program code when the condition is satisfied.

The present invention further provides a recording medium with an information erasing function. The recording medium is a recording medium detachably mounted on a computer, comprising a data transfer means for transferring data to and from the computer, a first area for recording specific information, and recording authentication data. A recording medium having a second area for recording, and a third area for recording an expiration date meaningful of the specific information, and authentication data received from the computer and recorded in the second area. A first determining unit for determining whether the current time has passed the expiration date recorded in the third area, and a first determining unit for determining whether the current time has passed the expiration date recorded in the third area. Means for autonomously rendering the specific information recorded in the first area worthless when the time does not match and / or when the current time has passed the expiration date. It is. The above-described information erasure is one form of “valueless”.

[0008]

Embodiments of the present invention will be described below. <First Embodiment> In the present invention, a server, which is an example of a first device, manages customer information, in-house information, and other valuable information (hereinafter, "specific information") in an integrated manner.
The present invention can be applied to a system in which a plurality of clients (second devices) connected via a computer network such as a (local area network) or the Internet can access and read specific information. The client is, for example, an information device such as a portable computer or a mobile phone. Here, when the specific information is transmitted from the server to the client, an erasing program that enables the specific information to be autonomously erased under certain conditions is also transmitted. An example of starting and executing a program will be described. Hereinafter, a specific information management system including a server and a client is referred to as an “information management system”.

FIG. 1 is an overall configuration diagram of the information management system. The information management system 1 is configured by connecting a server 10 and a plurality of clients 20 via a computer network. The server 10 includes a transmitting and receiving unit 11 for transmitting and receiving information including the specific information 131 to and from the client 10, an information control unit 12 for managing and controlling information to be transmitted and received, the specific information 131 and the erasing program 132, and the client 20. Information 13 about passwords and passwords
3 includes an information recording unit 13 for storing the information. The transmission / reception unit 11 can be realized by hardware such as a communication port and a data input / output mechanism and known communication software. The information control unit 12 is a function formed by the CPU of the server 10 reading a predetermined program code from a recording device (such as a hard disk) (not shown) and executing it. The information recording unit 13 is a nonvolatile memory. It is also possible to share this non-volatile memory with the above recording device.

On the other hand, the client 20 includes a transmitting / receiving section 21 for transmitting / receiving information to / from the server 10, an information control section 22 for managing and controlling information to be transmitted / received,
1 and an erasing program 232, an information recording unit 23 for storing the initial batch processing program 233, and a clock unit 24 for measuring the current time based on the system clock. These functions 21 to 23 are formed by the CPU of the client 20 executing a predetermined program code, similarly to the server 10. The clock unit 24 may use another clock server or the like provided in a computer network without depending on its own system clock. The information recording units 13 and 23 are, for example, non-volatile memories including a hard disk, a semiconductor memory held by a battery, and a flash ROM.

Next, an operation mode of the information management system 1 configured as described above will be described. As an initial stage, specific information and the like are exchanged between the server 10 and the client 20 according to the procedure shown in FIG. If necessary, the client 20 requests the server 10 to transmit specific information through the transmission / reception unit 21 (L201). When the server 10 receives the request from the client 20 through the transmission / reception unit 11, the information control unit 12 sets the information on the client 20, the content of the request from the client 20, the authentication information of the client 20 and the person who operates the client 20, and the specific information. The management information 133 including the erasure condition is created (V201). The management information 133 is recorded in a predetermined management area of the information recording unit 13. Here, the erasing condition is a lapse of a specific date and time. When the management information 133 is created, the information control unit 12 sends the client 20
The requested specific information 131, the erasing program 13
In addition to 2, the authentication information and the batch processing program rewriting command are transmitted (L202).

When the client 20 receives the above information from the server 10 through the transmission / reception unit 21, the information control unit 22 causes the specific information 231 (same as the specific information 131) and the erasing program 232 (same as the erasing program 132).
Is stored in the information recording unit 23. Further, the contents of the prepared initial batch processing program 233 are rewritten (C201).

The initial batch processing program 233 is a program in which a command for performing batch processing at an initial stage when the computer is started is recorded. For example, a well-known Microsoft OS (operating system) is used. WINDOWS (registered trademark) and M
In S-DOS (trademark of the company), "AUTOEXEC.
"BAT" is this. Initial batch processing program 2
When rewriting 33, the contents of the initial batch processing program 233 before rewriting are changed and saved.
In the example of MS-DOS, “AUTOEXEC.
BAT ”is stored as“ AUTOEXEC.OLD ”.

FIG. 3 and FIG. 4 are diagrams showing the processing at the time of starting the client 20 after the specific information 231 is recorded. The client 20 determines that the power is on, and determines that the firmware (BIOS: basic input / outp
ut system, etc.), and initializes the system (S300). Thereafter, the information control unit 22 executes a process according to the initial batch processing program 233 (FIG. 3: A). The outline of this processing is as shown in FIG. That is, when the date and time of the system is acquired from the clock unit 24 (S311: done), it is first determined whether or not the date and time meets the erasing condition (S312). If the date and time do not conform to the erasing condition, that is, if the date and time of the system has not passed the date and time defined in the erasing condition (S3
12: non-conformity), and shifts to normal OS processing (S32)
0). “Normal OS processing” refers to processing for constructing an environment for making the specific information available in the client 20 (FIG. 3: B).

If the current date and time has passed the date and time specified in the erasing condition (S312: conformity), the user of the client 20 is requested to input a password (S3).
13). If a password is input (S314: valid) and the password is valid (S315: valid), the process proceeds to a normal OS process (S320). Even if it is determined that one password input is invalid, the password is not immediately improper, and usually, the booter is given a chance to try a predetermined number of times of password input.

If it is determined that the password is invalid (S3
15: illegal), the specific information 231 and the erasing program 232 are erased from the information recording unit 23 (S316). The erasing method in this case is as follows. When the OS is MS-DOS, the “delete” command is executed by specifying the specific information 231. The corresponding area (directory or the like) of the specific information 231 is initialized. Overwrite the corresponding area (directory etc.) with a blank symbol etc. Instead of erasing the recorded specific information 231 itself, the recording medium on which the specific information 231 is recorded may be damaged or read out. Note that the above-described erasing method is an exemplification, and other forms can be appropriately adopted.

Thereafter, the initial batch processing program 233
Rewrite the contents of Instead of rewriting, a previously saved file may be restored. For example, “AUTOEXEC.OLD” is changed to “AUTOEXEC.OLD”.
By restoring to "BAT", rewriting can be performed. As a result, the client 20 can use the information recording unit 2
3 has no trace of the specific information 231 and the erasing program 232 recorded thereon, and can be a normal computer, and the security of the specific information 231 is perfect.

In the above description, the lapse of the date and time is set as the erasure condition for erasing the specific information 231. However, this condition is an example and is not intended to limit the lapse of the date and time. That the current situation is not between specific times (eg, between 9:30 on June 1, 2000 and 9:30 on June 10, 2000);
Is not connected to the computer network, that the client 20 has a certain vibration, that the client 20 is running on a battery, that the remaining capacity of the battery is less than a certain value, that the client 20
That no specific hardware or software is set in the client 20, that a prohibited action has been taken against the client 20,
It may be set as the above condition that a certain operation is not performed on 0 periodically. In these cases, information that can determine whether or not the condition is satisfied can be input as appropriate.

In the first embodiment, an example is shown in which a password input is requested when the erasing condition is satisfied (FIG. 4, S312: compliant) (S313 to S315).
The password input is not essential, and this process can be omitted.

Furthermore, in the first embodiment, the erasing program 232 is sent from the server 10 to the client 20 together with the specific information 231. However, the erasing program 232 may be incorporated in the client 20 in advance, or may be stored on a recording medium (compact flash ( (Registered trademark) Card, Flash AT
An erasing program 232 may be separately provided by a memory card such as an A card.

The erasing program 232 is installed in a portable recording medium such as a flexible disk, and the server 1
When a program for browsing the data held on the 0 side is activated, the erasing program 232 may be activated through the browsing program. The processing performed by the initial batch processing program 233 can be performed at the stage of the processing at the time of the initial startup of the firmware (FIG. 3, S300) and the processing of the initial startup of the OS (S320, FIG. 3).

<Second Embodiment> The present invention can be applied to a recording medium (hard disk, memory card, etc.) alone. In this case, the first device is a device that writes information to a recording medium, for example, a computer, and the second device is a recording medium. FIG.
FIG. 1 is a diagram showing the principle when the present invention is applied to a hard disk having an information erasing function. This hard disk 3
0 is a general standard (AT attachment, SC
3.5 according to SI (small computer system interface)
It has an inch or 2.5 inch recording medium 32. The hard disk 30 has a control board 31 that reads and writes data from and to a recording medium 32 in accordance with a command from a computer (which is a first device) to which the hard disk 30 is mounted, and erases data recorded on the recording medium 32. An additional substrate 33 for performing processing is provided.

The functional configuration of the additional board 33 is as shown in FIG. That is, a control unit 331 that exchanges data with the control board 31, a clock 332 that is an example of a clock unit, and a non-volatile memory 333 in which condition information defining the contents of the erasing operation and the erasing conditions are recorded. And a battery 334 for operating them. The control board 31 periodically checks the date and time measured by the clock 332, for example, about once a minute, and operates according to the condition information and the like recorded in the memory 333.

The information erasing function in the hard disk 30 is realized by the processing procedures shown in FIGS. As a premise, in the initial state, a state in which erasing conditions are not set in the memory 333 (the same applies to all spaces, etc.) and a state in which the memory 333 is connected to an external computer (linked with a power supply line) or not Is recorded. The setting of the erasing condition is based on an instruction from an external computer, and is limited to a case where the power of the computer connected to the hard disk 30 is on.

The control unit 331 confirms that the power supply of the computer is on (S701: ON).
When it is confirmed that the erasure condition is not set in (S
702: not set), and waits for reception of a control command from the computer (S703). The control command uses an instruction that is not used for normal control. The control command is sent to the control board 31 through an interface on the computer side. After the control board 31 interrupts the additional board 33, the control command is transmitted to the control unit 331 transparently.

When receiving the control command (S703: YES), the control unit 331 sets an erasing condition on the memory 333 according to the erasing instruction included in the control command (S704). The erasing conditions include, for example, a range of data on the recording medium 32 to be erased, conditions for initiating an erasing operation (such as the arrival of a date and time), an erasing method (erasing with a space, etc.) Examples include a password and a processing method when an incorrect instruction is received.

When the erasing condition is set, the controller 331
Notifies the control board 31 that the condition setting is completed, and enters a standby state (S705). In the standby state, the battery 334
To control the clock 332, and the control unit 331 periodically determines whether or not an erasing condition is satisfied. If the control unit 331 determines that the erasing condition is satisfied,
The fact that the state is waiting for erasure is recorded in No.3.

The computer is turned on (S70).
1: ON, S706: ON), and the fact that a wait for erasure is recorded in the memory 333 (S801: Ye)
s), the control unit 331 temporarily stops communication performed between the hard disk 30 and the computer through the control board 31 (S802). Then, according to the erasing conditions set in the memory 333, erasing processing of the specific information recorded on the recording medium 32 is performed (S803). When the erasing process is completed (S804), communication with the computer is restarted (S805).

<Third Embodiment> The present invention can be implemented in a memory card (flash memory or the like) as shown in the schematic view of FIG. This memory card 4
0 is a control board 41, a memory element group 4 for recording information
2. It comprises an additional substrate 43.

The contents of the additional board 43 are the same as those of the additional board 33 in the hard disk 30 shown in FIG. Further, the procedure of the erasing process of the specific information using the additional substrate 43 is almost the same as the processing procedure shown in FIGS. The difference is that the specific information is deleted (FIG. 8, S
801 to S805) are performed irrespective of the state of the power supply of the computer, and the process of S706 in FIG. 7 is omitted, and after the process of the standby state of S705, the process of S702 is performed.

As described in the above embodiments, by applying the present invention, a recording medium (or recording medium)
Since the specific information recorded in the is automatically deleted when the specified conditions are satisfied, it is possible to reliably prevent the leakage of the specific information even if it is passed to a third party. it can.

The present invention provides, for example, a hard disk for recording important information in a notebook personal computer, a recording medium for storing personal information in a cellular phone or the like, a time-limited information recording card such as a credit card or a debit card,
The present invention can be applied to various fields such as an information recording IC card with security used for license management in a software time lending business.

By combining with a general personal authentication technique, for example, an authentication technique using a password or a biometric feature, information management with higher security can be performed. Also, compared to the case using encryption technology, CPU
Since the ability is not used much, the degree of deterioration of the performance of a portable personal computer or the like is small. Furthermore, since the existence of the security technology as in the present invention is not known to a third party, even if the personal computer or the recording medium storing the specific information is stolen, the information analysis can be performed by the third party. No motivation to do it. Furthermore, even if the specific information is deleted, the function as a general device or system is secured, and the practicality is not impaired.

As described above, the apparatus, system, and recording medium to which the present invention is applied can reliably prevent information leakage while employing a simple and safe method, and have extremely high practicality as a product. Things.

[0035]

As is apparent from the above description, according to the present invention, the specific information recorded on the recording medium becomes autonomously worthless when a predetermined condition is satisfied. Even when the medium reaches the hands of a third party, there is a unique effect that information leakage can be reliably prevented.

[Brief description of the drawings]

FIG. 1 is a diagram schematically illustrating an information management system according to a first embodiment.

FIG. 2 is a sequence chart showing an initial communication procedure between a server and a client.

FIG. 3 is a schematic diagram of processing at the time of starting a client.

FIG. 4 is a diagram showing a detailed processing procedure at the time of starting a client.

FIG. 5 is a schematic functional diagram of a hard disk according to a second embodiment.

FIG. 6 is a schematic functional diagram of an additional board.

FIG. 7 is an exemplary view showing a procedure of a process of erasing specific information in a hard disk.

FIG. 8 is a diagram showing a procedure of a process of erasing specific information in a hard disk.

FIG. 9 is a schematic functional diagram of a memory card according to a third embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Information management system 10 Server 11, 21 Transmission / reception part 12, 22 Information control part 13, 23 Information recording part 20 Client 24 Clocking part 30 Hard disk 31, 41 Control board 32 Recording medium 33, 43 Additional board 40 Memory card 42 Memory element group 43 additional board 131,231 specific information 132,232 erasing program 133 management information 231 specific information 233 initial batch processing program 331 control unit 332 clock 333 memory 334 battery

Claims (7)

[Claims] 1. An information recording medium for recording specific information, an erasing condition for erasing the specific information recorded on the information recording medium, an information range to be erased, and a setting for setting an erasing method. Means, determine whether or not the current situation satisfies the erasure condition, and when the condition is satisfied, the specific information recorded on the information recording medium is determined according to the set information range and the manner of erasure. An information management device, comprising: an autonomous erasing means for autonomously erasing. 2. The information management apparatus according to claim 1, wherein the setting unit is configured to be able to receive all or a part of the erasure condition, the information range, and the erasure method together with the specific information from an external device. . 3. The computer according to claim 1, wherein the external device is a predetermined computer connected to the own device, and the setting unit determines whether the power of the computer is on or off. The information management device according to claim 2, wherein the information management device is configured to receive all or a part of the erasure condition, the information range, and the erasure method from a computer. 4. The method according to claim 1, wherein the setting unit, the determining unit, and the autonomous erasing unit are realized based on a program code readable by the own device. The information management device according to claim 1, wherein the information management device is configured to disappear. 5. The apparatus according to claim 1, wherein said determination means performs operator authentication when determining that the erasure condition is satisfied, and said autonomous erasure means erases said specific information only when operator authentication fails. The information management device according to claim 1, wherein 6. A first device and a second device capable of exchanging information with each other, wherein the first device transmits specific information stored in its own device to the second device in response to a request. A program code for causing the specific information to be autonomously erased under predetermined conditions is sent together with the program code, and the program code is incorporated into the second device. The second device receives the specific information received from the first device. And an information recording medium for recording the program code, and determining whether or not the current situation satisfies the condition, and if so, activating and executing the program code to be recorded on the information recording medium. An information management system having autonomous erasing means for autonomously erasing specific information. 7. A recording medium detachably mounted on a computer, a data transfer means for transferring data to and from the computer, a first area for recording specific information, and predetermined authentication data. And a recording medium having a third area for recording an expiration date meaningful of the specific information, and a second area for receiving authentication data from the computer.
First determining means for determining consistency with the authentication data recorded in the area; and second determining means for determining whether the current time has passed the expiration date recorded in the third area. Determining means; and means for autonomously rendering the specific information recorded in the first area valueless when the authentication data does not match and / or when the current time has passed the expiration date. A recording medium with an information erasing function.