JP2006270281A - Remote data eraser for information leak prevention - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an invention which has both a function of "the information leak prevention of a burglary information apparatus" at the theft and missing of an information apparatus such as a cellular phone, a PDA, and a mobile PC set as a (first target), and a function of "daily work recovery by an alternative information apparatus (hand information apparatus) set as a (second target). <P>SOLUTION: In this eraser, an arbitrary hand information apparatus (110) is selected at hand, the eraser has a relay server (120) in which an assignment change is possible at at the occurrence of burglary so that the burglary information apparatus (130) can be controlled by the hand information apparatus (110), and various controls are carried out by using an information apparatus management ledger (140), by the relay server (120). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

The present invention relates to a mobile phone, PDA, mobile PC, memory card, network (Internet), mail communication, and security (information leakage prevention) technology.

(Corresponding to Claim 1) This is a field of information leakage prevention such as theft of mobile phones.
As a function for preventing information leakage of a stolen information device, there is a function of simply erasing information or a function of simply locking a key (Japanese Patent Laid-Open No. 2003-319453).

  (Corresponding to Claim 2) Although there is a technique for erasing a stolen information device by remote control, there is no technology for continuing daily operations with a local information device.

  (Corresponding to Claim 3) As for server-controlled remote data erasure, there is JP-A-2004-32073.

(Corresponding to Claim 4) The technique used here is a general e-mail transfer setting technique.
In general, it is considered that e-mail transfer is used when transferring one mail to a plurality of devices (one-to-n transfer), but the present invention does not use such a mail transfer for backup. .
The e-mail transfer of the present invention is limited to the one-to-one transfer setting, and when switching the incoming mail from X to A, it is important to prevent X from being separated from the X (first goal). Feature). Further, by allowing A to receive a call, it is possible to continue the daily work (corresponding to the second target).

JP 2003-319453 A JP 2004-32073 A

Clarification of the problems of the prior art These prior art problems simply delete the information to be protected from the theft information device, simply make the information inaccessible, and simply discard the valid information just before the theft It was only.
In other words, theft of information equipment is only caught in the solution of the information leakage problem in (1) despite the two problems of (1) the problem of information leakage (2) the problem of suspension of daily work. And (
In the resumption of daily operations in 2), it took several months after the theft (especially thorough e-mail address dissemination).

The present invention has (first goal) “prevention of information leakage of stolen information devices” when information devices such as mobile phones, PDAs, and mobile PCs are stolen or lost.
It is an invention that combines both of them, with "Restoration of daily work in Japan" as a (second goal).

The local information device (110), the relay server (120), and the theft information device (130) are configured from the local information device (110) via the relay server (120).
Information leakage prevention system that controls the information, in addition to the information leakage prevention technology of "user data (including address book and bookmarks)" of the prior art, a new information leakage prevention technology of "mail arrival", The problem is that more advanced information leakage countermeasures can be taken (first target response).

In addition, it is a problem that daily operations can be continued in the local information device (110) by switching (switching) all of these confidential information from the theft information device (130) to the local information device (110) (No. 1). 2).

Supplementary information on claims 1 and 2 (reason for adding "incoming mail change" to confidential information)
As the world progresses, when mobile phones become daily necessities, there may be situations where it is necessary to take measures to prevent information leakage while using stolen mobile phones. The present invention
Application in such a case is also assumed.
For example, in recent kidnapping cases, mobile phone emails are used to communicate with criminals and identify where the criminals are. In such a situation, it is necessary to keep the mobile phone usable and prevent leakage of confidential information. The conventional technology for disabling mobile phones (remote data erasure and remote lock) has a drawback that it cannot cope with such a situation. An object of the present invention is to make it possible to take measures against information leakage (measures such that a stolen information device can be used and a confidential e-mail cannot be received after theft) even in such a situation.

Especially about Claim 3, in order to shift from the theft information device (130) to the local information device (110), some information device management must be performed. The present invention is implemented by collecting these pieces of information in one place and posting them on a relay server. In other words, the information device management ledger (140) for managing information on information devices in advance is provided so that the above-described purpose can be achieved, and it is always active even if it encounters an emergency such as theft of information devices. It must be posted on the relay server (120) that can be used. The present invention has this means.

In particular, the management information for mail transfer includes physical mail address (ac) and logical mail address (
Only when all (a plurality of) information devices are managed according to a rule such that ad) is clearly distinguished, free mail transfer is realized. That is, in advance, as feasible
It needs to be organized and managed. The present invention has this means.
In environments where the conventional logical mail address (ac) and physical mail address (ad) are not distinguished, there are harmful effects such as mail circulation (forward transfer with tail at head) and forwarding to mailing list mail address (permanent ping-pong). The mail may not be transferred correctly. The purpose of distinguishing the above is to remove this harmful effect. Especially in the event of an emergency situation, it is necessary to make a quick decision and make mistakes. The present invention has this means.

In particular, claims 3 and 4 (summary)
As with general earthquakes and fire disasters, everyday mental preparations can save lives, just like fire drills. The same can be said about information. The present invention introduces the idea of preventing information leakage by providing sufficient daily management against a disaster called theft of information equipment.
That is, if a countermeasure is taken after the theft, the remote data erasure or remote lock area is not left, but the present invention does not cause trouble even if it is stolen.
) Is managed (preparation of everyday mind), so that the information at the time of theft can be controlled quickly so as not to be troubled.

This will be described with reference to FIG.

Claims 1 and 2 A relay server capable of selecting an arbitrary hand information device (110) at hand and changing the assignment at the time of theft so that the hand information device (110) can control the theft information device (130). (1
20), and the relay server (120) performs various controls using the information device management ledger (140).
First, as a first preparation stage, the user logs on to the relay server (1) and connects (2) the theft information device (130).
In the “mail arrival” switching (150) of the theft information device (130), the main mail is sent to the server in advance, and switching is performed at the time of theft (change of mail transfer setting). The mail transfer is changed (3) to the information device (110).
In the “data” switching (160) of the theft information device (130), data conversion is performed according to various backups (161) such as backup via server (5) and local desk backup and backup format under server control (4). (Model conversion) (162) is performed.
After this, the theft information device (130) performs final processing such as data erasure (6) and treats it as a discard (
7) (achieving the first object).
Next, the backup data of the theft information device (130) acquired by the backup via server (5) or the like is restored (8) to the local information device (110), and then transferred from the theft information device (130) to the local information device (110). Transfer.
As a result, the “mail incoming” and “data” of the theft information device (130) are stored in the local information device (
110), the daily work can be continued (9) (achieving the second objective).
Details of claims 1 and 2 will be described in detail with reference to FIGS.

About Claim 3 The information device management ledger (140) of the relay server (120) in FIG. 1 is a ledger in which all information devices are managed. According to this information, the theft information device (130) to the local information device (11)
Switch to 0). The usage of this ledger will be described in detail with reference to FIG.

About Claim 4 In the relay server (120) of FIG. 6, there are a logical mail address (ac) and a physical mail address (ad) as items in the information device management ledger (140). In accordance with this information, the information is switched from the theft information device (130) to the local information device (110). A specific transfer setting method will be described with reference to FIGS. 2, 3, and 4 of the first embodiment.

Until now, information devices such as mobile phones, PDAs, and mobile PCs that have been lost or stolen can only be erased remotely to prevent information leaks, such as remote data erasure and remote mail banning. To recover, it took a lot of time and effort, such as searching for a backup and announcing the sender's email address change. By utilizing the present invention, the hand information device (110) is restored to the current status simultaneously with theft processing (remote data erasure), so that daily operations can be continued without stagnation. By returning immediately, there is no troublesome infrastructure setting change after theft.
That is, it is possible to minimize damages due to theft of information equipment (information leakage and daily business suspension).

Precondition of the present invention: mobile phone, PDA, mobile PC, but it is necessary to have both a battery and a communication device. Also. A control information device (mobile phone, PDA, PC) is required. That is, all information devices must be managed by the relay server.
Also. The mail flow must also be managed by the relay server in daily work.

The concept of processing will be described with reference to FIG. 1 (example of mobile phone theft).
First, the user logs on (1) to the relay server from any local information device (110). Next, from the local information device (110), input the information device management number of the theft information device (130),
The server processing of the incoming mail switching (3) is performed after connecting the local information device (110) and the theft information device (130) (2).
Next, the theft information device (130) is remotely operated.
Log on to the theft information device (130) (4), memory backup (5), erase the data, turn off the power (6), and discard the theft information device (130) (7).
Returning to the server process again, information restoration (8) to the local information device (110) is performed. At this point, the local information device (110) is restored (9) to daily work.

Here, the incoming mail switching (3) will be described in detail (FIGS. 2, 3, and 4).
Prerequisite: An information device in the information device management ledger (140) of the relay server (120) has a logical mail address (ac) (address associated with a person such as Taro) and a physical mail address (ad) (phone number 090- 1234-5678), which can be used to freely change mail transfer settings (150).

FIG. 2 is an example (conceptual diagram) of one mail switching.
Suppose Taro has a mobile PC and a mobile phone, and the mobile phone is stolen. At this time, the e-mail address is assigned in advance as follows, and the transfer settings are changed as follows at the time of theft.
These mail addresses are managed by a physical mail address (ac) and a logical mail address (ad) which are items of the information device management ledger (140) of the relay server (120).
The ledger is updated in synchronization with theft.
[Normal] transfer settings set in advance (before theft) are as follows.
(Refer to the upper part of Fig. 2 [Normal]]
Logical mail address forwarding settings Physical mail address
taro1@csvr.co.jp → tmoba@tmoba.co.jp (Mobile PC)
taro2@csvr.co.jp → tkei@tkei.co.jp (mobile phone)
The information device management ledger (140h) at this time has a local information device (110) record (a) and a theft information device (130) record (x). Since the information device management ledger (140h) is normal, the stolen information device (130) has not been stolen yet. Theft information equipment (130)
Is still at hand.
Here, if your mobile phone is stolen or lost (see the bottom of Figure 2 [when stolen])
taro2@csvr.co.jp tmoba@tmoba.co.jp (Mobile PC)
Transfer settings are good, so the transfer settings are
taro2@csvr*.co.jp → tmoba@tmoba.co.jp (Mobile PC)
It becomes. At the same time, the route of tkei@tkei.co.jp is blocked.
The information device management ledger (140t) at this time has a local information device (110) record (a) and a local information device (110) additional record (b) at the time of theft, and the local information device (11)
0) The additional record (b) at the time of theft is the record (x) of the normal theft information device (130).
Make a copy from.
The record (x) of the stolen information device (130) is excluded from the information device management target after the above copying.
That is, the management ledger (140t) at the time of the theft of the information device management ledger is the stolen information device (13
0) indicates a stolen state, and the record (x) of the theft information device (130) cannot be used or is not used. If applied to a phenomenon occurring in the actual world, this information device (130) is in a stolen state, and since it is actually not at hand at present, it means an information device (130) that cannot be used.
This information is reflected, and the information device management ledger (140) is updated.
The above is the concept of incoming mail switching.
A detailed description of each item of the information device management ledger (140t) will be given with reference to FIG.

FIG. 3 is a specific layout diagram of the mail server.
Since the mail server and the mail transfer server are conventional techniques, mail servers scattered around the world are used. In order to realize the present invention, a new mail server and mail transfer server are required. This figure clarifies the relationship between the sides.
Sharing of Server Functions Logical mail addresses (ac and bc) are managed by a mail server that is the number of mail switching functions (150) on the relay server (120).
The mail transfer setting is managed by the mail transfer server (150) which is the number of mail switching functions (150) on the relay server (120).
The physical mail address (bd) generally uses mail servers (receiving servers) scattered all over the world. That is, the physical mail address (bd) is generally not on the relay server.
This physical mail address (bd) is described as a certain location A and a certain location X in the example of FIG. These layout views are shown in FIG.

The details will be described below. (Explained in Fig. 3)
The transfer setting when the received mail (bc) of the theft information device (130) is stolen is as shown in FIG.
The received mail (ac) is mail addressed to taro1@csvr.co.jp. This is the email address used when sending email to Taro. This was originally transferred to tmoba@tmoba.co.jp,
This email is received by the local information device (110). Since this is a local information device (110) and not a theft information device, there is no need to change mail forwarding.

Next is the setting on the server when the theft information device (130) is stolen.
The received mail (bc) is mail addressed to taro2@csvr.co.jp. This is the e-mail address used when sending to Taro-san (to his mobile phone). This was an email that was forwarded to tkei@tkei.co.jp and received by the information device (130) before the theft, and this information device (130) encountered theft.
As described in FIG. 2, the information device management ledger (140) switches from the information device ledger (140h) to the information device ledger (140t) when the theft information device (130) is stolen.
This ledger first records the record (x) of the theft information device (130) with the local information device (
110) starts with copying to the additional record (b) at the time of theft.
A detailed description of each item of the information device management ledger (140t) will be given in FIG.
For email settings, send email to taro2@csvr.co.jp (bc), tmoba@tmoba.co.jp
By performing transfer switching to mail addressed to (bd), it is possible to receive mail at the local information device (110). A specific process of switching will be described with reference to FIG.

FIG. 4 shows the relationship between the server information device management program and the conventional mail transfer setting program. The server information device management program uses a transfer source address (bc) and a transfer destination address (
The two mail addresses bd) are transferred to the mail transfer setting program, and the actual mail transfer is switched.
The relay server stores the program name (storage location), calling method, and stored data to be called, and uses this to specifically call the conventional mail transfer setting program.

Next, details of the entire processing flow will be described with reference to FIG.
Process flow (Figure 5)

(Server side processing)
(1) Logon from local information device (110) to relay server (120) (1)
When an information device is stolen, an arbitrary information device that can be practically operated at the hand managed by the relay server (120) is selected as the hand information device (110). Log on (1).
When logging on (1), the information device management number is sent to the relay server (120) and the information device management number (aa) in the information device management register in the server indicates whether the information device is valid. The password (ab) is compared and determined, and if it is OK, the process continues.

(2) Connection of hand information device (110) and theft information device (130) (2)
After logging on (1) to the relay server (120), by further inputting the theft management number (xa) from the hand information device (110), the hand information device (110) and the theft information device (130).
). In other words, the correspondence (assignment) between the theft information device (130) and the local information device (110) is determined (this allows the local information device (110) to take control of the theft information device (130) and control it. This will be described in detail in (4)).

(3) Change incoming mail forwarding destination to local information device (110) (3)
Since one information device has a logical mail address (bc) and a physical mail address (bd), by transferring this logical mail address (bc) to the physical mail address (ad) of the local information device (110), Switch mail forwarding settings.
The precondition for this is that every e-mail of the theft information device (130)
This is possible when receiving from the logical mail address (xc). Such rules are adhered to, and a managed information device can be switched when it is stolen.
Details of the mail transfer setting change have already been described with reference to FIGS.

From the next processing, it is a remote operation to the theft information device (130).
(Remote processing from here to theft information device (130))
(4) Logon to theft information device (130) (4)
Log on (4) to the theft information device (130).
That is, the user logs on to the theft information device (130) from the relay server (120).
The mobile phone is determined to be a stolen object for the first time here.
This logon is a logon that takes control of the theft information device (130), and is slightly different from a normal logon. Details will be described.
First, the theft information device (130) is set to the “half-locked” state.
This “half-lock” means that only the process logged on this time is executed, and the theft information device (130).
Is to enter a locked state (operation prohibited state).
If there is another job running on the theft information device (130), it is canceled and locked (cannot be restarted).
For models that can use a memory card, it is locked in an unplugged / inserted state (while it is inserted), but only this logon process can be accessed.
If the theft information device (130) is not turned on, it is turned on.
Also, battery insertion / removal is locked.
If the theft information device (130) performs any authentication, it is ignored. This is a so-called forced logon. The control right is the local information device (110) or the relay server (12
0) and not in the theft information device (130).
That is, the half-locked state refers to a state in which a series of jobs (automatic start automatic execution) for remote data erasure can be executed, and other jobs cannot be executed or started.
The theft information device (130) is set to the above processing mode, and the next processing continues.

(5) Data backup of theft information device (130) (5)
If necessary, backup of the theft information device (130) is acquired here.
The backup target information is all security target information and includes memory card information and the like.
Determination example of whether to perform backup It is necessary to make a determination according to the theft situation of the theft information device (130), such as the battery consumption of the theft information device (130) being severe. It is not necessarily information that can be secured.
If it cannot be secured, it will be restored using a daily backup that is one generation old.
The backup of the old generation is naturally managed in advance in the information device management ledger (140).

(6) Data deletion / logoff of theft information device (130) (6)
Delete all confidential information.
Subsequently, the next cleanup process is performed.
-Remote lock of theft information device (130) (lock that cannot be turned on again)
・ Power off the theft information device (130) (cannot be turned on manually again)
-Log off the theft information device (130).

Hereinafter, the description will be given in order. The remote lock of the theft information device (130) here is a mode in which a complete lock is made and no job can be restarted.
That is, the theft information device (130) cannot be turned on again.
Also, if there is a memory card, it can be inserted and removed, and all access is disabled and locked.
The power-off of the theft information device (130) logs off to the theft information device (130), which means that manual re-input from the theft information device (130) is disabled.
This is an event indicating that the processing of the theft information device (130) has been completed, and generally occurs at the same time as the power is turned off.
The processing for the theft information device (130) in this item is completed.
The new incoming mail change has already been performed in (3) (no incoming call).
If necessary, the deletion job completion information is transferred from the theft information device (130) to the relay server (
120) Via Send to local information device (110).

(7) [Operation] Disposal of theft information device (130) (7)
This item is operational. The theft information device (130) is disposed of.
That is, since the information is completely erased from the theft information device (130) and no information leakage occurs, the theft information device (130) can be forgotten.

(Server side processing again)
(8) Restoration / logoff to local information device (110) (8)
The security information of the stolen information device (130) is restored to the local information device (110).
When restoring (8), if it is different from the backup model, the model is converted (162) and restored. Finally, log off from the relay server (120).
The processing for the relay server in this item is finished.

(9) [Operation] Resurrection of daily operations on local information device (110) (9)
This item is operational. The daily work is restored with the local information device (110).
Thereafter, the local information device (110) is continuously used.
The above is the flow of the process of the first embodiment shown in FIG.

Next, a method for updating the information device management ledger (140) of the relay server (120) will be described with reference to FIG. 6 (1) Logon from the local information device (110) to the relay server (120) (1)
Prepare any local information device (110) and log on to the server (1).
120) is the information device management number (aa) on the record (a) of the information device management ledger (140).
) And the logon password information (ab) to check whether the device is valid.

(2) Connection of hand information device (110) and theft information device (130) (2)
Next, when a stolen information device management number (kan023) is input from the hand information device (110), the correspondence between the hand information device (110) and the theft information device (130) is determined. As a result, the local information device (110) and the stolen information device (130) are linked on the management ledger (140).
Information device number (xa) and password (xb) of record (x) of theft information device (130)
) Is disabled. This is to make it impossible to log on to the relay server from the theft information device (130).
Next, record (b) is copied from record (x) of the stolen information device (130) to the lower part of record (a) of the local information device (110).
Next, the record (b) is updated. Update the following items.
The update location for each item of the information device management ledger (140t) is as follows.
-Information device management number (ba): Updated to unavailable "-"-Same as password (bb): Updated to unavailable "-"-Logical mail address (bc): This is the same as the theft information device (130) is there. (Xc → bc)
Physical mail address (bd): This is the same as the local information device (110) (ad → bd)
Model (be): Device symbol of the local information device (110),
When the model (Xe) of the difficult information device is different, the model of the updater is converted.
Status flag (bf): A serial number in which the first record of the local information device (110) is 1.
In the example, enter 2. 0 means use stop.
Backup data (bg): This is data21 before conversion and data22 after conversion, (b
g22 stores data22.
The update location is as described above.
The update location for each item of the information device management ledger (140t) is as described above.

(3) Change destination of incoming mail address to local information device (110) (3)
In (2) above, since the stolen e-mail address source (bc) is changed to the local information device (110) e-mail address transfer destination (ad), the e-mail transfer setting is changed with this e-mail address.
Thus, the local information device (110) is the original mail (ac) and theft information device (130).
Is transferred to the transfer destination address (ad = bd) of the local information device (110).

From the next processing, it is a remote operation to the theft information device (130).
(Remote processing from here to theft information device (130))
(4) Logon of theft information device (130) (4): No ledger update (5) Data backup of theft information device (130) (5)
The backup information is stored in the backup information (xg) of the record (x).
Example is data21.
Next, the model is converted to data 22 and stored in (bg).
At the time of model conversion, the conversion program is started after seeing the difference between the models (xe) and (ae).
The backup here is the latest backup (data21) after the theft. However, this backup may have been tampered with by others, and the data may be corrupted.
In such a case, the latest is not rewritten. That is, the backup (data 22) at the time of linking (2) of the local information device (110) and the theft information device (130) is stored as one generation old.
You can use the most convenient of these.

(6) Data deletion / logoff of theft information device (130) (6): No ledger update (7) [Operation] Discarding theft information device (130) (7): No ledger update This item is operation. Here, the theft information device (130) is disposed of as disposal.

(Server side processing again)
(8) Restoration to local information device (110) (8)
The security information of the stolen information device (130) is restored to the local information device (110). The restoration (8) may involve model conversion (162).

(9) [Operation] Resurrection of daily operations on local information device (110) (9)
This item is operational. The daily work is restored with the local information device (110).

If you are dissatisfied with the above model conversion (if there is a shortage), or if the theft information device (130) has failed to backup, restore a few generations old and update it in your daily work It will be.
Thereafter, the local information device (110) is continuously used.

The more a network (information society) advances, the more information is leaked inadvertently and carelessly. On the other hand, information leakage can also jeopardize corporate trust. That is, double and triple safety measures are required. In order to prevent information leakage, there is a simple method of erasing data, but it should be applied only when there is no other choice and an emergency stop is unavoidable.
However, if there is room, the stolen information device should be extinguished after switching the stolen information device to the local information device and returning to the current state as in the present invention.
Applicable fields include theft and loss of mobile phones, PDAs, mobile PCs, etc., and information devices placed in unnatural conditions (eg, information devices left in dangerous locations, disasters, etc.) Neglected information devices left in the past, mobile phones without the owner (such as death of a traffic accident)).
In addition, some information devices placed in an unnatural state may be able to be operated at hand. In such a case, the self-destruct button of the stolen information device may be used as a trigger for starting the job of the present invention. Also good. That is, the emergency self-destruct button of the stolen information device may be used to delete (separate) itself from the information device management ledger.

A conceptual diagram of a remote data erasing device. Mail transfer change conceptual diagram. The layout of the mail server. The figure which shows the communication between mail server programs. The figure which shows the flow of a remote data deletion job. The figure explaining the update method of a relay server information device ledger.

Explanation of symbols

1 ... Logon from the local information device to the relay server, 2 ... Connection between the local information device and the theft information device, 3 ... Change of incoming mail forwarding destination to the local information device, 4 ... Logon to the theft information device,
5 ... Data backup of theft information device, 6 ... Data erasure / logoff of theft information device, 7
... [Operation] Discarded theft information equipment, 8 ... Data restoration / logoff to local information equipment, 9 ... [
Operation] Resurrection of daily operations on hand information device, 110 ... hand information device, 120 ... relay server, 1
30 ... Theft information device, 140 ... Relay server information device management ledger, 140h ... Relay server information device management ledger (normal), 140t ... Relay server information device management ledger (when stolen), 150 ...
Mail switching, 160 ... data migration, 161 ... backup file, 162 ... data conversion, 170 ... data deletion, a ... hand information device record, aa ... hand information device information device management number, ab ... hand information device password, ac ... hand Information device Logical mail address, a
d: Hand information device Physical e-mail address, ae: Hand information device Model, af: Hand information device Status flag, ag: Hand information device Backup, b ... Hand information device (addition at the time of theft) record, ba ... Hand information device ( Information device management number, bb ... Hand information device (added during theft) Password, bc ... Hand information device (added during theft) Logical email address, bd ... Hand information device (added during theft) Physical E-mail address, be ... Hand information device (added when stolen) Model, bf ... Hand information device (added when stolen) Status flag,
bg ... information device at hand (additional amount for theft) backup, x ... theft information device record, xa
... theft information device information device management number, xb ... theft information device password, xc ... theft information device logical mail address, xd ... theft information device physical email address, xe ... theft information device model, xf ... theft information device status flag, xg ... theft information equipment backup.

Claims (4)

A theft information leakage prevention system that consists of a local information device, a relay server, and a theft information device, and controls the theft information device remotely (with communication means) from the local information device via the relay server. A remote data erasure device that makes all information subject to security protection subject to information leakage, in addition to “user data erasure” and “mail incoming call change” as a leakage prevention measure. A remote data erasing device having means for restoring daily operations at a local information device by switching the information to be protected from a stolen information device to a local information device. A remote data erasing device in which necessary information of an information device is stored and managed in advance in an information device management ledger of a relay server in order to switch confidential information from a stolen information device to a local information device. For incoming mail control, between two different mail addresses, a logical mail address (address associated with a person such as Taro's mail address) and a physical mail address (address associated with a device such as telephone number 090-1234-5678). Remote data with a set of information devices that are managed in advance so that they can be transferred freely in any combination and can continue daily operations even if they are stolen or lost. Eraser.

Images